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PREFACE 



APPLIED MICROSYSTEMS CORPORATION is proud of its role in the 
systems development industry and conscious of its important contribution. 
However, it assumes no liability for errors or for any damages that may 
result from use of this manual or the equipment it accompanies. 

We have made every effort to document this product accurately and 
completely. We reserve the right to make changes to this manual without 
notice. 

The ESI 800 Emulator is intended for use in developing, debugging, and 
testing Intel 80186/88 microprocessor-based systems. This manual 
assumes the user is familiar with the terminology and capabilities of the 
80186/88 microprocessor. 

Unpacking and Inspection 

Your Emulator has been inspected and tested for electrical and mechanical 
defects before shipping, then configured for the line voltage you 
requested. Although the Emulator was carefully packed, check it for 
possible transit damage and verify that the following units are present. If 
you find any damage, file a claim with the carrier and notify Applied 
Microsystems Corporation (Customer Service 1-800-426-3925). 
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STANDARD EQUIPMENT 

■ Emulator chassis with power cord 

■ Main control boards and pod assembly 

■ ES1800 Emulator Reference Manual for 80186/88 
Microprocessors 

OPTIONAL EQUIPMENT 

■ Control Boards 

■ overlay memory 

■ symbolic debug 

■ Logic state analysis pod assembly 

■ Carrying case 



Pre face 



Warning 

This equipment generates, uses, and can radiate radio frequency energy 
and if not installed and used in accordance with the instructions manual, 
may cause interference to radio communications. It is temporarily 
permitted by regulation and has not been tested for compliance with the 
limits of Class A computing devices pursuant to Subpart J of Part 156 of 
FCC Rules, which are designed to provide reasonable protection against 
such interference. Operation of this equipment in a residential area is 
likely to cause interference. It is up to the user, at his own expense, to take 
whatever measures may be required to correct the interference. 
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Service 

If the ESI 800 unit needs to be returned for repairs, Applied Microsystems 
Customer Service will issue a Return Authorization number. To obtain the 
necessary Return Authorization number and shipping information call 
1-800-426-3925, and ask for Customer Service. After the expiration of 
the warranty period, service and repairs are billed at standard hourly rates, 
plus shipping to and from your premises. 



iv 



Preface 



Limited Hardware Warranty 

Applied Microsystems Corporation warrants that all Applied Microsystems 
manufactured products are free from defects in materials and 
workmanship from date of shipment for a period of one (1) year, with the 
exception of mechanical parts (such as probe tips, cables, pin adapters, test 
clips, leadless chip sockets, and pin grid array adapters), which are 
warranted for a period of 90 days. If any such product proves defective 
during the warranty period, Applied Microsystems Corporation, at its 
option, will either repair or replace the defective product. This warranty 
applies to the original owner only and is not transferable. 

To obtain warranty service, the customer must notify Applied 
Microsystems Corporation of any defect prior to the warranty expiration 
and make arrangements for repair and for prepaid shipment to Applied 
Microsystems Corporation. Applied Microsystems Corporation will 
prepay the return shipping to US locations. For international shipments, 
customer is responsible for all shipping charges, duties and taxes. Prior to 
returning any unit to Applied Microsystems Corporation for warranty 
repair, a return authorization number must be obtained from Applied 
Microsystems Corporation's Customer Service Department (see Service 
section). 

This warranty shall not apply to any defect, failure, or damage caused by 
improper use, improper maintenance, unauthorized repair, modification, 
or integration of the product. 
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Hardware Extended Warranty 

Applied Microsystems Corporation's optional EXTENDED WARRANTY 
is available for all hardware products for an additional charge at the time 
of the original purchase. The EXTENDED WARRANTY may be 
purchased to extend the warranty period on mechanical parts normally 
restricted to 90 days to a total of one (1) or two (2) years and to extend the 
warranty on electrical parts and all other mechanical parts to two (2) years. 

Hardware Service Agreements 

SERVICE AGREEMENTS are available for purchase at any time for 
qualified Applied Microsystems Corporation manufactured products. The 
SERVICE AGREEMENT covers the repair of electrical and mechanical 
parts for defects in materials and workmanship. For information, contact 
your local sales office. 
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Section 1 



INTRODUCTION 



The ESI 800 Emulation system allows you to analyze and control a target 
environment, consisting of hardware or software, in real time. To use the 
ESI 800 with your target hardware, simply remove the target system's 
microprocessor and plug in the ESI 800 Emulator. Your system uses the 
Emulator in place of the microprocessor and behaves as if the target 
microprocessor were there. It continues to run until you manually stop it 
or it encounters a user-defined stop condition. This predefined condition 
can be in the form of single-step operation statements or more complex 
event monitoring (WHEN/THEN) statements. 

During the debugging or integration process you can read and write to the 
microprocessor registers or memory locations and execute programs 
contained in the target system memory. The ESI 800 Emulator also allows 
you to debug software without being physically connected to the target 
system. In this configuration, the Emulator uses its own real-time clock 
feature combined with overlay memory capabilities. 

Information in this manual applies to the Intel 80186/88 microprocessor 
only. For more complete information on this chip, refer to the Intel 
hardware reference manual iAPX 86/88, 186/188 User's Manual 
published by Intel Corporation. 
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How to Use This Manual 

This manual is your guide to using the Applied Microsystems 
Corporation's ESI 800 for the 80186/88 microprocessor. For your first 
time using the ESI 800, read through the Introduction and Getting Started 
sections and refer to the Hardware section to make sure your hardware is 
set up correctly. 

Once you are familiar with the Emulator, Chapters 4, 5, 6 and 7 provide 
information on all of the available commands. The comprehensive index 
and Appendix A: ES Language Mnemonics are useful for finding specific 
information in the manual. 

The manual is organized as follows: 

Section 1: Introduction introduces Applied Microsystem Corporation's 
ESI 800 Emulator for the 80186/88. It explains emulation, setup, and 
configuration requirements, and provides an overview of the features of 
the ES1800. 

Section 2: Getting Started provides a checklist for setting up the Emulator 
and target system, starting and testing the Emulator, and storing 
customized system variables in EEPROM. 

Section 3: Hardware contains all the information on the Emulator, the 
control boards, the rear panel, the pod, and the serial ports, as well as 
information on maintenance and troubleshooting. 

Section 4: ES Language explains the structure of the language that 
controls the Emulator, with explanations of the help menus, prompts, 
special modes and characters, and language related error messages. 

Section 5: System Commands provides a reference to commands that 
control the Emulator system. It is divided into sections on setup, serial 
communications, download operations, registers, trace memory, macros, 
and symbols. 

Section 6: Target Commands provides a reference to commands that 
directly control the target system. It is divided into sections on running the 
target program, overlay memory commands, the line assembler, the 
memory disassembler, memory and I/O modes, and special functions. 
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Section 7: Event Monitor System explains the powerful breakpoint and 
control system, including the structure of the system, breaking emulation, 
counting events, using special interrupts, and tracing events. 

The Appendices are quick references to ES Language mnemonics and 
explanations of the hardware error messages and serial data formats. 
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System Setup 

The ESI 800 can debug and integrate software and hardware. Setups for 
each system may be different. In every combination, there is a "target" 
system, which can be hardware, software alone (if you are using the 
Emulator's overlay memory to debug software), or a combination of the 
two. The target system is the environment you intend to emulate. 

The ESI 800 Emulator consists of a chassis assembly which houses the 
control boards and an Emulator pod which houses the emulating 
microprocessor. The Emulator can be controlled with a terminal, which 
can be your development system CRT or another device set to function in 
terminal mode. You can enhance this basic system by adding the optional 
logic state analyzer (LSA) pod. This provides 16 additional input lines, 
giving access to signals other than the normal address, data, and control 
signals of the microprocessor. You may also add an optional overlay 
memory board. Overlay memory can be mapped anywhere in the address 
space of the target system. The overlay memory board provides additional 
capabilities, including the ability to debug software with or without a 
target system. 

The stand alone environment (refer to diagram in Figure 1) consists of the 
Emulator and a dumb terminal or equivalent connected to the terminal 
port. This configuration can debug target systems with software already 
installed or short, hand-entered routines. The stand-alone configuration is 
common in manufacturing test and service facilities. 

The Emulator can also use data stored in a host development system by 
setting up a hosted environment (refer to diagram in Figure 1). The 
Emulator is still under the direct control of the CRT but can load data 
from the host system's data files. 

By attaching a printer, data and code from the target system can be printed 
out in assembly language. You can also print all Emulator commands and 
their results. The Emulator system has two serial ports and uses standard 
RS232C serial port protocol. Each port can be independently configured 
for baud rate, data length, and number of stop bits. 

Software for driving the Emulator is available from Applied Microsystems 
Corporation for the IBM PC and compatibles, SUN, APOLLO and VAX. 
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The Emulator can also be totally controlled by a host system. This hosted 
software environment (refer to diagram in Figure 1 ) requires special host 
resident software. Drivers and high level debuggers are available from 
Applied Microsystems for most languages and host systems. 



Figure 1. Environments 
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System Operation 

OVERVIEW 

The ESI 800 has two basic operational modes: emulation and pause. Pause 
mode is generally used to set up the system configuration and to display 

infnrtYiofiAti of for avifinn omiilotiAn Q\ro i-£*tYi cotim 10 orr»Amn1iorioH f i*/™im 
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two menus. The first menu contains all external communication variables; 
the second contains the control switches for emulation. Both setups can be 
saved to EEPROM and automatically loaded at power-up. 

Emulation, or run mode, means that the microprocessor in the Emulator 
pod is running a program in the target system, allowing you to see what is 
happening within the target system. Emulation stops when (l) you stop it, 
(2) user-defined breakpoints are enabled and occur, (3) you reset the 
system, or (4) errors occur in the target system. 

When you manually stop emulation or a breakpoint is reached, you enter 
pause mode. All registers and addresses are then available for 
examination, along with a trace history of performance of the 
microprocessor. A command language allows you to enter emulation mode 
in the desired state and leave emulation when the desired combination of 
events are detected in the target. 



ES LANGUAGE 

The ESI 800 uses its own command language. To benefit from the 
sophisticated operations of the Emulator, you must understand the general 
concepts of this language. The Emulator operates in response to command 
statements composed of command mnemonics and, for some commands, 
arguments. An argument to a command is an additional value entered as 
part of the command sequence, such as an address range or base value. 
Arguments can consist of single values, expressions, or lists. 

The command statements form a control language, similar to higher-level 
computer languages. And, like a computer language, the operators and 
values can be combined to form complex expressions. Statements have a 
maximum length of 76 characters and can be extended by the use of 
macros. 
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The ES Language contains registers, counters, and conditional statements 
allowing the user full control over the operation of the target system. To 
complete the language, a full set of error messages is provided for (1) target 
hardware, (2) Emulator hardware, (3) target software, and (4) ES 
command language syntax. 

REALTIME 

Since the pod processor is identical to the target microprocessor, the target 
system runs in real time. No wait states are inserted by the Emulator 
during run mode. 

NULL TARGET 

When there is no target system, you may select the internal clock feature, 
which places the Emulator in null target mode. Overlay memory can then 
be used to develop code as if a target system were attached. In this mode a 
4 MHz clock is supplied to the CPU through a divide by 2 network. The 
CPU runs at 2 MHz. Unterminated inputs are set inactive. 

TRACE MEMORY 

Trace memory functions as a history of the target system program's 
execution. This memory can record 2046 bus cycles and display these in 
assembly language. All address lines, data lines, processor status lines, and 
16 bits of external logic input are traced. If something unexpected happens 
during program execution, trace memory can be reviewed to determine the 
sequence of instructions executed by the CPU prior to the unexpected 
event. When used in conjunction with the trace disassembler, hardware 
and software problems can be quickly tracked down. 

Trace memory can be selectively switched on by the Event Monitor to trace 
events only when certain conditions are met. Program execution can be 
stopped at any point, either manually or using the Event Monitor System. 
The address, data, and control signals of the most recently traced cycles can 
then be critically reviewed. 
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OVERLAY MEMORY 

Overlay memory is Emulator working memory, which can be used in a 
variety of ways. When debugging software without target hardware, the 
target program is loaded into overlay memory, where it can be edited and 
positioned in the target system address space as desired (null target mode). 
The program executes in real time as if it resided totally in the target 
system. Overlay memory is also useful when a target is connected, for 
loading portions of software, making patches, and checking programs not 
yet committed to PROM. 

The overlay memory is RAM with appropriate address and control logic, 
ranging in size from 32K to 2M bytes and locatable in 2K-byte segments 
throughout the system. Each segment can be assigned one of four 
attributes: target, read/write, read-only, or illegal. Unmapped memory is 
assigned the target attribute by default. Overlay memory mapped as read- 
only can always be modified by the Emulator operator. However, if a 
program tries to write to read-only overlay, emulation stops and an error 
message is displayed. Overlay memory mapped as read/write can be 
written to or read from. If a program attempts to read or write to memory 
mapped as illegal, emulation stops and an error message is displayed. 

When a segment of memory is mapped, program accesses in that memory 
range are directed to the overlay instead of the target. Overlay memory 
accesses occur in real time, with no wait states added by the Emulator. 

EVENT MONITOR SYSTEM 

The ES1800's Event Monitor System provides unprecedented breakpoint 
and system control, enabling the user to isolate and break on any 
predefined series of events and then perform actions defined by 
WHEN/THEN conditional statements. The user controls and monitors the 
target with the Event Monitor System by defining statements that specify 
exact or multiple events through logical combinations of address, data, 
status, pass counter, and optional logic field states. When those events are 
encountered in the target system program, the ESI 800 can break 
emulation, trace specific sequences, count events and trigger outputs all 
independently, allowing the user to analyze the cause-effect relationship 
established by the event/action sequences defined. 
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The Event Monitor System uses four groups containing eight registers each 
to let the user monitor a complex series of events through multiple actions 
and combinations of comparator registers. The system uses one group at a 
time, with each WHEN/THEN statement active in a specific group. 
WHEN/THEN statements can switch to different groups and access 
conditional statements and registers for that group. The user can control 
the tracing of 2046 machine cycles, selecting the desired instructions to be 
recorded in the trace memory. 

OPTIONAL SYMBOLIC DEBUGGER 

The symbolic debug option allows you to assign frequently used values to 
symbol names that make sense. Features include: 

■ Reference to an address by a name instead of a value 

■ Display of all symbols and sections with their values 

■ Editing (entry and deletion) of symbols and their values 

■ Automatic display of symbolic addresses during 
disassembly 

■ Section (module) symbols that can be used as range 
arguments and for section offsets in trace disassembly 

■ Upload and download of symbol and section definitions 
using standard serial formats 

Because symbols are a powerful extension of the Emulator, they are 
frequently used in examples throughout Section 5, System Commands. 
Please note that if you have not yet purchased the symbolic debug option, 
you may need to modify these examples. 
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OPTIONAL LOGIC STATE ANALYZER (LSA) 

LSA inputs can qualify event specifications in the Event Monitor System. 
In the simplest form, specific bit patterns at the LSA inputs can cause a 
breakpoint. The LSA comparator can detect arbitrarily complex event 
specifications as well. The LSA allows tracing of additional signals in the 
tareet svstem. This is useful when mnnitnrinp buffers smnpip.teH nf 

«-> - •> — o \- / ~ Jf : 

failure, (2) decode logic, (3) memory management circuit translations, and 
(4) for asynchronous external events. 

DIAGNOSTIC FUNCTIONS 

Diagnostics available in the ESI 800 Emulator include both RAM/ROM 
tests and scope loops. RAM test routines verify that RAM is operating 
properly. They can be run on the target or Emulator overlay memory and 
may be executed in either byte or word mode. ROM tests include a built- 
in CRC algorithm. 

High speed memory and I/O scope loops for troubleshooting with an 
oscilloscope are built into the Emulator firmware. They can be used for 
locating stuck address data, status or control lines, and generating 
signatures using signature analysis equipment. 

The firmware that generates the scope loops is optimized for maximum 
speed of execution. This short cycle time allows the hardware engineer to 
review the timing of pertinent signals in the target system without using a 
storage oscilloscope. The scope loops can be executed in either byte or 
word mode. 
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Section 2 



GETTING STARTED 



Introduction 

This section provides a checklist for setting up the Emulator and target 
system, starting and testing the Emulator and storing customized system 
variables in EEPROM. 



Emulator Setup 

1. Refer to page 3-1 and verify that proper grounding and 
power requirements have been met. 

2. Remove the front cover of the Emulator by turning the 
thumbscrews counterclockwise. The pod and LSA pod 
may need to be unplugged in order to do this. 

3. Verify that the main control board and the memory 
control board are in the top two slots of the Emulator 
chassis. (See page 3-4 for board positions.) 

4. Verify that the trace/break board is in the third bus slot 
of the Emulator chassis. (See page 3-4 for board 
positions.) 
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5. If you are using overlay memory, verify that the RAM 
overlay master, and/or master and slave boards, if 
needed, are inserted. (See page 3-4 for board positions.) 

6. Verify that the correct Emulator board for your target 
microprocessor is in the bottom slot. (See page 3-4 for 
board positions.) 

7. Verify that all boards are firmly seated in their 
motherboard connectors. (See page 3-4 for board 
positions.) 

8. Set the thumbwheel switch on the main control board for 
your particular system variables (see page 3-5 for 
thumbwheel switch location. 

System default variables in switch position 0 are: 



- 9600 baud - 8- bit word length 

- One stop bit - No parity 
• Full duplex - No echo 

■ Terminal control • XON and XOFF are recognized 

- 8th data bit set to 0 (space) 



9. Verify that the three-position toggle switch on the 
memory control board is in the center position. See page 
3-7 for location illustration. 

NOTE: If you are using an early ESI 800 model, the above 
comment may not apply. Follow the instructions 
provided at the time of purchase. 

10. Replace front panel and attach the correct pod assembly 
(see page 3-8). A pod assembly must be connected to the 
Emulator even if you are not connecting it to a target 
system. 

1 1 . OPTIONAL: Connect logic state analyzer pod (see page 
3-9). 
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12. Verify that the RS232C cable connections are correct for 
the system configuration you plan to use (see page 3-10, 
Pin Configurations). 

13. Verify that the RS232C baud rates and data requirements 
are set the same on both the Emulator and the terminal. 
See page 3-5 for thumbwheel switch settings =) 

14. If using communications without a modem, you may need 
a null modem cable. If you purchase a null modem cable, 
it is likely to have the following configuration. 

1 1 

2 2 

3 3 

4 4 

5 5 



6 — l _ I 6 ' 

8 • • 8* 

20 ^ 20* 

7 7 



Check the specifications in your terminal manual before 
reversing the pins. 

* Note that pins 6, 8, and 20 are not used and are 
unaffected by the cable configuration. 
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Target System Setup 

1 . Check that the target has a 68 contact leadless chip carrier 
socket. An adaptor, Part No. 210-00023-00, is available 
for plastic leaded chip carriers. 

2. Using an ohmmeter, check that a good ground exists at 
the microprocessor socket. Measure from pin 26 and 60 
to power supply ground on the target board. 

3. Verify that all the power supplies in the target system are 
functioning oronerlv 

4. Check for a valid clock signal at the target microprocessor 
socket. 

5. Turn off target system power and Emulator power. 

6. Plug in the probe tip. (See page 3-14 for probe tip 
precautions.) 
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Power-Up Sequence 

TARGET SYSTEM PRESENT 

1 . Turn on the target system. 

2. Turn on the Emulator. 

3. Reset the target system (see page 6-13). 

NO TARGET SYSTEM 

1. Verify that the pod is connected to the Emulator (see 
page 3-8). 

2. Be sure there is nothing in contact with the probe tip. 

3. Power-up the Emulator. 

4. The power-up banner should be displayed. Select the 
internal clock source. 

When you power-up the Emulator, all registers, maps, event clauses, and 
system variables are either cleared or set to default values. Examine the 
SET and ON menus (see pages 5-3 and 5-9) and configure the system to 
your liking. Your special setup can then be stored in EEPROM (see page 
5-25). By setting the rotary switch on the controller board to the proper 
position, your set-up can be autoloaded on power-up. (See page 3-4.) 

The ESI 800 Emulator system is now running and ready to accept ES 
language commands. 
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Test Run of System 

Use this test guide after the system configuration is correct and the ES 
prompt is displayed ([>])• 

A system test run consists of the following 9 steps: 

1 . Initialize Emulator. 

2. Map overlay memory. 

3. Test overlay memory. 

4. Enter a program. 

5. Verify a program. 

6. Run the Emulator. 

7. Stop the program. 

8. Display the trace buffer. 

9. Set a breakpoint. 

This test requires an optional overlay memory board. This demonstration 
does not need a target system. 

If you suspect trouble with the ESI 800 hardware, call the Applied 
Microsystems Corporation Customer Service hotline at 1-800-426-3925 
for assistance. 

1. INITIALIZE THE EMULATOR 

Enter the following to initialize the Emulator: 

>SET 1 f 0;SAV:SET 1,1;SAV;SET 1,0 

This will save any changes you have made to the six categories of variables, 
which include the SET menu (see page 5-3). This operation can take up to 
four minutes if major changes have been made. 
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Do not interrupt the operation. 
2. MAP OVERLAY MEMORY 

Map all of the overlay memory available to the Emulator. 



>map o to xxxx 



(Where XXXX is the ending address (in hex) of the amount of RAM 
overlay installed.) The following table provides a quick reference for hex 
values corresponding to overlay memory sizes: 



Hex value 


Overlay Memory 


7FFF 


32K 


OFFFF 


64K 


1FFFF 


128K 


3FFFF 


256K 


7FFFF 


512K 



For example, to map 64k, enter: 



>MAP 0 to OFFFF 



For more information, refer to page 5-56. 
3. TEST RAM 

Test all overlay memory installed by entering: 



>SF 1,0 to xxxx 



(Where XXXX is the ending address (in hex) of the amount of overlay 
memory 7 installed.) If there is a failure, repeat mapping and testing. 

For more information, refer to diagnostic functions, page 6-50. 
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4. ENTER PROGRAM 

Enter a short program by invoking the line assembler and entering 8086 op 
codes (see page 6-30). 



>ASM 10 

**** 8086/88/186/188 LINE ASSEMBLER VX.XLA **** 
CSEG = XXXX 

0010>NOP 

001 1>/ 

0012>/ 

0013>/ 

0014>/ 

0015>JMP 10H 
0017>X 



NOP is a null operation. Each time you type the slash ( {/} ), you repeat the 
previous command, so you have entered the equivalent of five lines of 
NOPs. The [x] at the end exits the assembler. 

5. VERIFY THE PROGRAM 

Single step through the program to, verify that it works, by entering: 



>cs = 0 

>IP=10 
>STP;DT 

>/ 
>/ 
>/ 
>/ 
>/ 



The disassembled trace should show that NOPs were executed and that the 
jump was taken correctly. 

For more information on the STP command, refer to page 6-7. 
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6. RUN THE EMULATOR 
Enter RUN. 



>RUN 
R> 

The [r>] prompt should be displayed with no error messages. This indicates 
the Emulator is running in real time, executing the program. 

7. STOP THE PROGRAM 

Enter STP to stop. 

R>STP 

The Emulator should stop running and display the CS:IP register value and 
Group 1. The CS:IP value should not exceed 0:15. 

8. DISPLAY THE TRACE BUFFER 

Enter DRT to display the execution history of the program. 

>DRT 



The display should show sequence numbers between 0 and 20, and address 
values between 10 and 30. 



>DTB 



This should show a disassembled trace of the program with NOPs and JMP 
10s. 
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9. SET A BREAKPOINT 

Verify that the Event Monitor System halts execution when a defined 
condition is met by setting a breakpoint. In this case, the Emulator 
executes 100 (hex) bus cycles, then breaks. 

Enter: 



>WHEN DC1 THEN 


CNT 


>WHEN CTL THEN 


BRK 


>DC1=0XXXX 




>CTL=100 




>RBK 




R> 





This causes the counter to be incremented each time data comparator 1 sees 
a data bus value between 00000 and 0FFFF. When the count limit of 100 is 
reached, emulation breaks. 



If a break does not occur: 

1. EnteraSTP. 

2. Set CS and IP to 0 and 10. 

3. Enter DES 1 and verify that you have entered the 
WHEN/THEN statement and comparator values as shown 
above. 

4. Type RBK again. 

If no break occurs call Applied Microsystems Customer Service at 
1-800-426-3925 for assistance. 

10. INITIALIZE PERIPHERAL CONTROL REGISTERS 

1 . Set up the PCB relocation register. If you do not relocate 
the peripheral control block from $FF00 in I/O space, 
then go to step 2. 
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Enter: 



>REL = <register value> 



Refer to the Intel iAPX 86/88, 186/188 User's Manual 
for the proper way to set up the PCB relocation register. 

2. Set up the on-chip chip select peripheral. If you do not 
use on-chip chip selects, then go to step 3. 

Enter: 



>0N RCS 



With RCS set to ON, the following will be true: 

Pause-to-run transitions will write the Emulator chip 
select PCB values into the target PCB. 

Run-to-pause transitions will read the Emulator chip 
select PCB values from the target PCB. 

Enter: 



>UMCS = 


<register value> 


>LMCS = 


<register value> 


>MPCS = 


<register value> 


>MMCS = 


<register value> 


>PACS = 


<register value> 



Refer to the Intel iAPX 86/88, 186/188 User's Manual 
for the proper way to set up the register. 

3. Set up the on-chip DMA peripheral. If on-chip DMA 
circuitry is not used, then go on to step 4. 
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Enter: 



>USRC0 




<register value> 


>SRC0 




<register value> 


>UDST0 




<register value> 


>DST0 




<register value> 


>XC0 




<register value> 


>CW0 




<register value> 



Refer to the Intel iAPX 86/88, 186/188 User's Manual 
for the proper setup. 

If you do not need DMA active while paused, then go on 
to step 4. 

Enter: 



>0N DME 



4. Set up the on-chip timer peripheral. If on-chip timer 
circuitry is not used, then go on to step 5. 

Enter: 



>TC0 




<register value> 


>TC1 




<register value> 


>TC2 




<register value> 


>MA0 




<register value> 


>MA1 




<register value> 


>MA2 




<register value> 


>MB0 




<register value> 


>MB1 




<register value> 


>MB2 




<register value> 


>MCW0 




<register value> 


>MCW1 




<register value> 


>MCW2 




<register value> 
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Refer to the Intel iAPX 86/88, 186/188 User's Manual 
for the proper setup. 

If you need a timer circuit active while paused, then turn 
on the appropriate emulator software switch, as follows: 



>ON TEO 
>0N TE1 
>0N TE2 



This will turn on timers zero, one, and two respectively. 

5. Set up the on-chip interrupt control peripheral. If on- 
chip interrupt control circuitry is not used, then proceed 
to step 6. 

Enter: 



>INT0 


= <register value> 


>INT1 


= <register value> 


>INT3 


= < register value> 


>EOI 


= < register value> 


>POL 


= <register value> 


>POL 


= <register value> 


>MSK 


= <register value> 


>PLM 


= <register value> 


>ISV 


= <register value> 


>IRQ 


= <register value> 


>IST 


= < register value> 


>TCR 


= <register value> 


>DMA0 


= <register value> 


>DMA1 


= <register value> 


>DMA2 


= <register value> 



Refer to the Intel iAPX 86/88, 186/188 User's Manual 
for the proper setup. 



2-13 



ES1800 Emulator Reference Manual for 80186/188 Microprocessors 



6. Display the status of the PCB registers. 



>PCB 



TVlf CCrAAn rlienloire +V> a currant r-n-n tnntp s\F tl,n "D/TJ 

registers. 

7. Set up overlay and a minimal program. This step assumes 
you have neither target memory nor a valid program 
located at the startup location (*FFFF0). If you have 
target memory and a valid program, then go on to step 8. 

Enter: 



>MAP $FF800;DM 



This maps in overlay from $FF800 to $FFFFF and 
displays the memory map. 

Enter: 



>0N RDY 



This ensures that reads and writes to overlay memory use 
the Emulator's internal ready signal. 

Enter: 



>ASM 



This invokes the single-line assembler to enter a sequence 
of NOP instructions. 
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Enter: 



>CSEG = OFFFF 



This sets the assembler to an absolute address of $FFFF0. 
Enter: 



>NOP 
>NOP 
>NOP 



This throw-away program initializes the on-chip 
peripheral circuitry. 

Enter: 



>x 



This exits the assembler. 

8. Activate the on-chip peripherals. The following tasks 
should have been accomplished before reaching this 
point: 

■ The state of all on-chip peripherals 
should have been set up via the PCB 
registers. 

■ The Emulator's ON and OFF software 
switches have been properly set up. 

■ A program resides at the start up location 
(SFFFFO). 
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Enter: 



>AC1 = <stopping point> 



This HpfinPQ thf» Qtnnnino nnint nf thf* nrnorom \i;Viir«f» 

— — w — ------ w V.W — » f-' f-- V J.**. V V *. H»V |_/ JL V Ml" » » 111V11 

should follow the initialize section. 

The on-chip peripherals are activated by either a read 
from, or write to appropriate registers. The setting of the 
Emulator's switches to ON guarantees the chosen 
peripheral registers will be written and read following the 
execution of at least one instruction cycle. Therefore, set 
up AC1, as either: 



AC1 = $FFFF2 



if manually initializing and using the NOP program in 
step 7, or 



AC1 = <stopping point> 



if using your own PCB initializing program. 
Enter: 



>WHEN AC1 THEN BRK 



This allows a breakpoint when AC1 is recognized during 
emulation. 
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Enter: 



>RST;RBV 



RST sends a reset signal to the target system via the 
RESET OUT line. 

RBV sets CS:IP registers to the absolute address of 
$FFFF0, activates the Event Monitor System, and 
initiates a real-time run. 
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HARDWARE 



Emulator Chassis Assembly 

The Emulator chassis is the metal enclosure housing the control boards for 
the target system. This rack-mountable chassis houses up to six boards as 
shown in the figure on page 3-4. 

The Emulator power supply is also in this chassis. A power switch on the 
rear panel is the only external panel control. 

WARNING! 

A cooling fan and vent for the Emulator are located on the left 
side panel of the chassis. The warm air exhaust vent is in the 
right side panel. Blocking either of these panels may cause the 
Emulator to overheat. 



SYSTEM GROUNDS 

The ESI 800 Emulator has three grounding systems: 

1. A chassis ground from the metallic enclosure of the unit 
to the power filter. 

2. An AC protective ground from the green ground wire of 
the AC power cord and the chassis ground at the power 
filter. 
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3. A signal ground connected by means of a jumper at the 
power supply terminal strip to the chassis ground. The 
Emulator has a three-wire power cord with a three- 
terminal polarized plug. The ground terminal of the plug 
is connected internally to the metal chassis parts of the 
Emulator. 

WARNING! 

Failure to ground the system properly may create 
a shock hazard. 
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Emulator Control Boards 

Removing the front panel of the Emulator chassis exposes the chassis card 
cage as shown in Figure 2. Open this panel by turning the two knobs in the 
upper corners of the front panel counterclockwise. 



Main Control Board 



The main control board holds the 
controlling 6809 CPU for the Emulator, the 
EEPROM, two serial ports, and RAM. The 
16-position thumbwheel switch on this 
board determines the system variables and 
serial line baud rates for autoloading on 
power-up. Refer to page 3-5, for each 
switch position setup. Switch position 0 
autoloads default system variables. 



Memory Control Board 



The memory control board holds the 
memory management logic and optional 
symbolic memory. The three-position 
toggle switch below the main control board 
thumbwheel switch must be in the center 
position. If the toggle switch is in either of 
the other two positions, the Emulator will 
not work properly. 



Trace/ Break Board 



The trace/break board holds trace memory, 
the Event Monitor System, and the logic 
state analyzer (LSA) interface. 



RAM Overlay 
Board( s ) 



The RAM overlay board set is optional and 
can hold 32K, 64K, 128K, 256K or 512K of 
memory. 512K of memory requires a slave 
board. 



Emulation Board There are six different emulation boards, 

depending on the target microprocessor you 
are using. (Refer to the diagram on the 
following page for the location of the label 
indicating the processor type.) 
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Figure 2. Control Boards 
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Emulation Board 






Thumbwheel Switch Settings 


POSITION 


PARAMETERS 


BAUD RATE 


0 


Factory Default* 


9,600 


1 


User "0" defined 


User defined 






Terminal control 




User "1" defined 


User defined 






Terminal control 




User "0" defined 


User defined 






Computer control 


/ 


User "1" defined 


User defined 






Computer control 


5 


Factory Default* 


110 


L 
O 


Factory Default* 


300 


7 


Factory Default* 


1,200 


8 


Factory Default* 


2,400 


9 


Factory Default* 


4,800 


A 


Factory Default* 


7,200 


B 


Factory Default* 


19,200 


C,D,E 


,F Reserved for factory use 


*Factory Default Parameters 




■ 8-bit word length 


- one stop bit 




- no parity 


- full duplex 




- Terminal control 


- XON and XOFF are recognized 


- no echo 


- baud rate the same 


for both terminals 




- 8th data bit set to 


0 (space) 



3-5 



ES1800 Emulator Kef erence Manual for 80186/188 Microprocessors 



Emulator Chassis Rear Panel 

The rear panel of the Emulator mainframe is shown in Figure 3 on page 
3-7. 

Serial Ports The two serial ports are RS 232C ports 

labeled [terminal] and [computer]. Pins are 



discussed on page 3-10. 

System configuration determines which 
port your peripheral equipment connects to 
(see page 1-4). 



Trigger Output The ESI 800 Emulator provides a TTL 

trigger strobe output controlled by the 
Event Monitor System. The trigger output 
is available at a BNC connector on the rear 
panel of the chassis and on a clip lead 
attached to the optional logic state analyzer 
(LSA) pod. Refer to Section 7 for 
information on Event Monitor System 
actions. 

The trigger can be used for such things as: 

■Synchronizing an 
oscilloscope to the execution 
of an I/O routine. 

■ Measuring the duration of a 
routine by asserting the 
trigger for its duration and 
using a timer-counter. 

■ Cross-coupling two or more 
Emulators so that an event 
in one can control events in 
the others. 
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Power Switch 



Before powering up, two items should be 
checked: 

1. Proper grounding of power cable 
(see page 3-1). 

2. Proper power-up sequence of 
Emulator, target system, and/or 
peripheral equipment. (See Power- 
Up Sequence, page 2-5.) 



Line Fuse 



A 3 amp slow-blow fuse for 1 10V operation 
or a 1.5 amp slow-blow fuse for 220V 
operations. Remove the fuse by turning the 
fuse holder counterclockwise. 



Figure 3. Rear Panel 




© o [ ir:::::::.\7^, ) o terminal 



0 [f.V.7^Y.-^| p. 



© [ DO ] □ 




115V/230V SWITCH 
LINE FUSE 




© 




© 



© 



AC POWER CONNECTION 
L- TRIGGER OUTPUT 
POWER SWITCH 
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Pod Assembly 

The pod assembly is the link between the ESI 800 Emulator and the target 
system. A 40-inch ribbon cable assembly connects the pod assembly to the 
Emulator board. An 11 -inch ribbon cable assembly ends in a probe tip 
that is normally inserted into the microprocessor socket in the target 
system. 

The proper pod assembly is determined by the microprocessor being 
emulated. 

To install the probetip, remove the retainer clip from the LCC socket, 
place the probe tip in the socket as you would the microprocessor, then 
replace the retainer clip. Always check that pin 1 is aligned correctly. 

On older model probes, the tip may be removed using the thumbscrew, to 
allow for easier access to the retainer clip. 

Figure 4. Pod Assembly 
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Logic State Analyzer (LSA) Assembly 

An optional feature, the logic state analyzer (LSA) pod assembly connects 
directly above the Emulator pod assembly. The LSA assembly includes a 
pod, cables, and probe clips. The LSA pod provides 16 input lines and one 
trigger output line. 

The one trigger output line behaves the same as the BNC signal on the rear 
panel of the Emulator and can be used with an oscilloscope. This allows 
triggering an oscilloscope or external logic analyzer for events that are set 
up in the Event Monitor System with a "then TGR" statement. 

Figure 5. Logic State Analyzer Pod Assembly 
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Serial Ports 

Both the terminal port and the computer port end in standard RS232C 
female connectors. Make sure peripheral hardware is connected to the 
correct port. 



Baud Rate 



Baud rates and data lengths for each port 
are independent. Refer to the SET 
command (page 5-3) for available baud 
rates on each port. 



U pload/ Download 



Port Control Only one port can be the controlling port. 

Either port can give control to the other 
port. (See page 5-30, 5-35, 5-36.) 

The Emulator accepts commands to begin 
uploading/downloading from either port. 
However, the Emulator uploads/downloads 
hex format data files only through the 
computer port. 

Your system configuration determines which port should be in control. 
Refer to pages 1-4, and 3-5. 



PIN CONFIGURATIONS 

The pin configuration of your equipment (terminal, PC or host) may not 
match that of the Emulator. It is important to be familiar with the pin 
configurations of all peripheral equipment you intend to use with the 
ESI 800 Emulator. 

The ESI 800 Emulator is configured as "Data Terminal Equipment" (DTE). 
Before powering up, make sure the ESI 800 Emulator system and 
peripheral hardware are compatible. Pins 1, 2, 3 and 7 must be connected 
to peripheral hardware. Pins 4 and 5 need to be connected if peripherals 
attached to the Emulator use these pins. 

Both Emulator serial ports use the same pin assignment. All pin 
assignments and voltage levels conform to Electronics Industries 
Association (EIA) RS232C standards. The following chart lists the signals 
present on each pin. 
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Pin Name 

1 Protective Ground 

2 Serial Data Out 

3 Serial Data In 

4 Request to Send (Output) 

5 Clear to Send (Input) 

6 Not Used 

7 Signal Ground 

8-25 Not Used 



Description 



Connected in the Emulator to 
logic ground. 

This signal is driven to nominal 
±12 voltage levels by an RS232C 
compatible driver. 

Data is accepted on this pin if the 
voltage levels (±12V) are as 
specified by RS232C 
specifications. 

This signal is driven to nominal 
±12V levels by an RS232C 
compatible driver. It signals other 
equipment that the Emulator is 
ready to accept data at this port. 

An input signal to the Emulator 
indicates that another piece of 
equipment in the system is ready 
to accept data. This signal is 
terminated so the Emulator 
operates with the signal 
disconnected. 



Connected in the Emulator to the 
system logic ground. 

These pins are not used by the 
ESI 800 Emulator, but may be 
required by your peripheral 
hardware. 
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DATA REQUIREMENTS 

Stop Bits The Emulator software transmits and 

receives 8 -bit ASCII characters. The 
number of stop bits is determined by SET 
parameter #11 for the terminal port and 
#21 for the computer port (see page 5-3). 

Parity The Emulator sends and checks parity 

according to system SET parameter #12 for 
the terminal port and #22 for the computer 
port. These two SET parameters are listed 
on the SET menu (page 5-3). 

Each character consists of a start bit 
followed by 8 data bits. When no data is 
being transmitted, the serial data out pin 
(pin #2) will be at the 12V level. 

Hardware Handshake When the Emulator is ready to receive data, 

it asserts the Request To Send line (pin #4). 
When a receive buffer is nearly full, the 
Emulator deasserts the Request To Send 
line. 

When the Emulator is ready to transmit 
data, it checks the status of the Clear To 
Send line (pin #5). Data is transmitted only 
when Clear To Send is high. 

The ESI 800 uses normal flow control codes 
to control software handshaking. The 
default values are XON (DC1) and XOFF 
(DC3). You can change these values (see 
page 5-3). 

The ESI 800 serial 1/0 system contains 
internal buffers to smooth the transmission 
of data via the serial ports. If an input 
buffer becomes nearly full, the system 
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immediately transmits an XOFF character. 
When the software empties the input 
buffer, the system transmits an XON 
character. 

Although the user cannot overfill the input 
buffer from a controlling terminal, a 
controlling computer is quite capable of 
doing so. The input buffer for the 
computer port is 64 characters deep. When 
eight characters have been placed in the 
computer input buffer, the XOFF character 
is transmitted. Allowing two character 
times for skew, the computer must transmit 
no more than 54 characters until the next 
XON from the ES1800. 

The RTS hardware handshake follows the 
software handshake described above. When 
an XOFF is transmitted, RTS is dropped on 
that I/O port; when an XON is transmitted, 
RTS is reasserted. 
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Maintenance 

Maintenance of the ESI 800 Emulator has been minimized by the extensive 
use of solid-state components throughout the instrument. There are three 
areas where you need be concerned. 

CABLES 

The interconnect cables are the most vulnerable part of the instrument, 
due to constant flexing during insertion and extraction. First, inspect the 
cables for any obvious damage, such as cuts, breaks, or tears. Even if you 
have thoroughly inspected the cables and cannot find any damage, there 
may be broken wires within the cables (usually located close to the ends). 
A broken wire within the cable will cause the instrument to run erratically 
or intermittently if the cables are flexed during emulation (run) mode. By 
swapping the cables in question with a known good set of cables, you can 
easily isolate the faulty cable. 

PROBE TIP ASSEMBLY 

The probe tip assembly consists of a ceramic lead-less chip, four ribbon 
cables and an adapter board. The adapter board is inside the pod case. 
When the Emulator is not in use, the protective cover should be installed 
over the ceramic chip to prevent cable abrasion and to protect it from 
being damaged by other objects. Folding or kinking of the ribbon cables 
may result in premature failure. 
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CLEANING THE FAN FILTER 

The fan filter should be cleaned regularly. The recommended interval is 
every 90 days. If you are working in a dusty environment, you may need 
to clean the filter more frequently. 

1. Unplug theES 1800. 

WARNING! 

Electrical shock and moving fan parts are 
dangerous. Make sure you unplug the unit before 
proceeding. 

2. Remove the front cover of the ES 1800. (Loosen the two 
captive fasteners.) 

3. Remove the top cover of the ES 1800. (Unscrew six 
screws and lift the cover off.) 
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5. Tilt the fan towards the boards in the chassis. 
ES 1800 With Fan Tilted for Easy Access to Filter 




6. Remove the fan filter. 

7. Rinse the fan filter in cold water. Thoroughly shake out 
the excess water. 

8. Replace the fan filter. 

9. Tilt the fan back into the correct position. 

10. Replace the screws connecting the top of the chassis to 
the fan. 

1 1 . Replace the top and front covers. 
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PARTS 

The following parts are available for you to order: 



Probe tip assembly 
Short cable set 
Long cable set 
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Troubleshooting 

Check that the interconnect cables are installed properly in a compatible 
target system, with power applied to both the target system and the 
Emulator before starting troubleshooting procedures. 

The most common problems encountered are listed below. We recommend 
that you contact Customer Service at Applied Microsystems Corporation if 
you experience any problems that do not fall within this range of items. 
Before you call our service department, display your software revision 
number by typing REV (page 5-124). You will be asked for the revision 
number and serial number when you call. Also, record the serial number 
located on the back of the chassis. 

We do not recommend a component-level repair in the field, unless 
performed by a qualified service engineer. 



Troubleshooting 



SYMPTOM 



POSSIBLE CAUSES 



Target system 
runs erratically 



1. Faulty interconnect cables 



2. Emulator and target system not compatible 



3. LDV not executed before RUN (vector not loaded). 



Emulator does 
not communicate 
over RS232 



2. Target system requires "null" modem 

cable (pin 2 and pin 3 of RS232 connector) 
reversed. 



1. Baud rate set incorrectly. 



3. Emulator configuration incorrect 



3-19 



ES1800 Emulator Reference Manual for 80186/188 Microprocessors 



ES1800 Emulator Specifications 

INPUT POWER 



Standard 



Optional 



ENVIRONMENTAL 

Operating Temperature 
Storage Temperature 
Humidity 

PHYSICAL 

Mainframe 

Emulator Pod 



90 to 130 VAC 
47 to 63 Hz 

consumption less than 130W 

180 to 260 VAC 
47 to 63 Hz 

consumption less than BOW 



0 °C to 40 °C (32 °F to 104 °F) 

-40 °C to 70 °C (-40 °F to 158 °F) 

5% to 95% relative humidity, non 
condensing 



13.2 cm x 43.18 cm. x 34.29 cm. 
(6.2 in. x 17 in. x 13.5 in) 

22.6 cm. x 12.9 cm. x 4.1 cm. 
(8.9 in. x 5.1 in. x 1.6 in.) 
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Target System 
Connection ( total 
length including pod) 

LSA Pod 

Total Weight 
Shipping 



1.5 m (60 inches) 

12.4 cm. x 7.9 cm. x 2.3 cm. 
(4.9 in. x 3.1 in. x .9 in.) 

9.1 kg. (20 lbs.) 

10.9 kg. (24 lbs.) 
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ES LANGUAGE 



Structure of the ES Language 

The command language used to control the ESI 800 Emulator is a formal 
language. Once you understand the basic concepts of this language, you 
can apply the full debugging power of the Emulator. An overview of the 
structure of the ES language is presented in the accompanying table. A 
more detailed description of the language elements, the help menu, 
prompts, special operating modes, and ES language error messages are also 
included in this section. Items in angle brackets ([<>]) are mandatory and 
must be entered as part of the command. 

Items shown in square brackets ( [a\ ) are optional. Do not type the angle 
or square brackets when typing a command. 

If the ESL command interpreter detects an illegal statement, it beeps and 
places a question mark under the command line near the position the error 
was detected. Enter a 0 following an error to display the appropriate error 
message. 
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ES Language Syntax 


Language Element 


Example 


Command Line 

[Repeat] Command Statement [;Command Statement] ... <RETURN> 
Single Character Instant Command 


Repeat 

<*> 

<*><Repeat limit> 


*STP;DT 
*9 STP;DT 


Repeat Limit: 

32 

Decimal number only (1 to 2 -1) 


87651234 


Command Statement 

Command Mnemonic 

Command Mnemonic <Expression> 

Command Mnemonic <Expression List> 

Assignment Command 

Expression 

Event Monitor System Control Statement 


DTB 

MM CS:IP + 4 
SET #20,#14 
CS = 0FA9 
2 * GR5 

WHEN AC1 THEN BRK 


Single Character Instant Command 

</> (repeat previous command line) 

<,> (execute macro 1 or decrement scroll in memory mode) 
<.> (execute macro 2 or increment scroll in memory mode) 
<?> (help) 




Command Mnemonic 

<1 or more alpha characters>[l or more decimal characters] ASM 


Expression 

[Unary Operator] lvalue 
lvalue <Operator> Expression 
<@> Expression 
<(> Expression <)> 
Nvalue <:> Nvalue 


-2473 

2 - 3F6C90 

a240;aaass:sp 

2 * (-2 + 3) 
CS:1234 
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ES Language Syntax ( cont ) 



Language Element 


Example 


lvalue: 

Symbol 
Nvalue 


1 ma i n 


Symbol: 

<'><! or more printable charactersXspace or return> 


Nvalue: 

Number 
Register Name 


7FA36 
IP 


Register Name: 

<1 - 3 Alpha characters>[0 - 


2 decimal digits] 


Number: 

[Base]<l or more digits> 


%0101001 


Base: 

<%> (binary) 
<\> (octal) 
<#> (decimal) 
<$> (hexadecimal) 




Expression List 

Expression <,> Expression [.Expression list]. 


1,CS:IP,2+2, -6 


Assignment Command 

Svalue <=> Expression 

<@> Expression <=> Expression 


IP = aOFFFFO 
asS:SP = CS:IP 


Svalue: 

Symbol 
Register Name 


■Test_resuLt 
MMP 
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ES Language Syntax ( cont ) 



Language Element 


Example 


it . ~ .„ * \/t — : * „ ~ c — i /-< — -i i Ci.i a 

ii»cm 1TJ.U111LU1 oj'siciii v^umiui otitic in cu i 

[Group] <WHE[N]> Event <THE[N]> Action List 


WHEN AC1 THEN BRK 


Group: 

<1> 
<2> 
<3> 
<4> 


2 WHE AC1 THE BRK 


Event: 

[Disjunctive] <Event Comparator> 
Event <Conjunctive> <Event> 


NOT AC1 

DC2 OR NOT AC1 


Disjunctive: 

<NOT> 




Event Comparator 

<AC1>[. Group] 
<AC2>[. Group] 
<DC1>[. Group] 
<DC2>[. Group] 
<S1>[. Group] 
<S2>[. Group] 
<CTL>[. Group] 
<LSA>[. Group] 


AC1 .3 
CTL.4 


Conjunctive: 

<AND> 
<OR> 

Action List 

<Action> [.Action] . . . 


TRC,TGR,FSI 
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ES Language Syntax ( cont ) 



Language Element 


Example 


Action: 




<BRK> 




<TRC> 








<C-iN 1 > 




<. i \j\-*^> 




<RCT> 




<TGR> 




<FSI> 




<GRO Group> 


GRO 3 


Unary Operator 




<ABS> 


ABS GD3 


<!> 


!0AA 




.7 

mJ 


Vr|JCI «. 1 til 




jviui.op 




Add.op 




Shft.op 




<&> 


GD4 & OFF 


<~> 


DC2.3 A OFF00 


Mul.Op 




<*> 


2*3 


</> 


OFAC / %01001 


<MOD> 


GD5 MOD 7 


Add.op 




<+> 


GRO + IP 


<-> 


a<SS:SP - 4) 


Shft.op 




«<> 


DC1 « 3 


<»> 
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Notes on ESL 

Command Line 



Repeat 



Command Statement 



A command line is created by entering one 
or more characters after the ESL prompt 
(see page 4-23 for a description of the 
various prompts). One or more command 
statements can be placed on a single 
command line. Multiple command 
statements must be separated by a 
semicolon. The command line is limited to 
76 characters and must be terminated with a 
return. The only way to extend command 
lines is by using macros (see page 5-102). 

Backspace or delete characters may be used 
to delete the previous character entered on a 
command line. CTRL X deletes the entire 
line. CTRL R redisplays the current line 
(useful for hardcopy terminals). 

If an asterisk (0) is the first character on 
the command line, the entire command line 
will be repeated indefinitely. If the asterisk 
is followed immediately by a decimal 
number, the command will be executed that 
many times. A repeating command line 
may also be terminated by setting the TST 
register to zero within the command line. 
This allows you to repeat something until a 
condition is met. 

There are several special modes in which 
the above command statement rules do not 
apply. In memory mode (see page 6-40), 
entering a |return| on an empty line causes 
the next location to be read. Entering a 
value followed by IreturnI will cause that 
value to be written to memory. I/O mode 
(page 6-38), the line assembler (see page 
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Single Character 
Instant Commands 



6-30), memory disassembler (page 6-36), 
and main help menu (page 4-20) all have 
special modes that alter the normal 
execution of ESL commands. 

These commands are processed immediately 
when they are the first character entered on 
a command line. The forward slash 
character ( 0 ) will cause the previously 
entered command line to be repeated. 



>STP 

>/ 
>/ 



This command single steps three times. 

The comma ( Q ) executes macro 1 , and the 
period ( [7] ) executes macro 2. However, if 
you are in memory or I/O mode, the period 
moves you to the next higher memory 
address, while the comma moves you to the 
next lower address. 

The question mark ( 0 ) also has two uses. 
It can be entered after the command 
interpreter detects an error and beeps. If 
you are "beeped," enter a [?] and the 
command processor will give you an error 
message describing the problem it detected. 

A [U entered at any other time (i.e., not after 
an error), causes a two-page Help Menu to 
be displayed. A |return[ moves you from 
the first page to the second. Any other 
character terminates the Help Menu. 
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Command Mnemonics Command mnemonics are the alpha- 

numeric character strings that identify a 
specific ESL command. Command 
mnemonics are formed from 1 to 3 alpha 
characters followed by 0 to 2 numeric 
characters. Extra characters in between are 
ignored. For example, |when| is the same as 



[wheI and |gr12345| is the same as |gr45| . See the 
Appendices for a list of all ES language 
mnemonics. 



Expression An expression can be an integer value, an 

alpha/numeric value, or an equation. 

Parentheses may be used to alter the normal 
precedence of operations. The Emulator 
recognizes parentheses just as they are 
treated in algebraic equations. You can use 
as many levels of parentheses as you need. 
The only limitation is that statements can be 
no more than 76 characters long. 

Parentheses are not allowed in 
WHEN/THEN clauses. 

The expression processor can resolve 
arbitrarily complex expressions. 



3(GD0 +3) = IP + #100 * (DX » 4) +0AF34 



This example retrieves the value of the DX 
register, shifts it right 4 bit positions 
(divide by 2 4 ), multiplies the result by 100 
decimal, adds 0AF34 and the contents of 
the IP register, and writes the result to the 
location 3 bytes above the address in GD0. 
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A more common and useful example might 
be: 



ASM CS:IP 



This computes the address CS:IP and starts 
up the line assembler at that address. The 
expression: 



1 Interrupt + 1A6 



by itself will add 1A6 to the current value 
of the symbol, Interrupt, and display the 
result. If you do not assign the results of an 
expression to a location or register, the 
result is displayed as a 32-bit value. 

The [a] operator is an indirection operator. 
|a Exp| (where |xp] is an expression) refers to 
the value in memory at the address [fxp]. If 



the |a Exp] is on the left side of an g then the 



value from the right side of the 0 will be 
loaded into memory at the address lExpj . At 



all other times, [a Exp| simply reads a value 



from memory. [ass:SP| is a simple way to 
read something from the stack pointer. It is 
legal to have multiple indirections, e.g., 
laaGRO = aaa(ss:sp + 6)1 . Byte mode and word 



mode affect the length of data transferred 
to or from the target by the [a] operator. 

The [7] operator mimics the arithmetic 
combination of segment and pointer 
registers in the 80186/88 microprocessor. 
The value on the left side of the colon is 
shifted left 4 bits, added to the value on the 
right side and, finally, the total is masked to 
20 bits. The colon operator is handled at 
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Symbols 



the preprocessor level and thus has higher 
precedence than normal math operators. 
The colon operator must be used only 
between actual numbers or register names; 
e.g., |cs:ip| is fine but lcs:(ip+5)| is illegal. 



All other math or logic operations are 
evaluated according to the order given in 
the following section on operators. 
Parentheses may be used to alter the normal 
precedence. Unary operations must be 
enclosed in parentheses if they occur within 
another expression; e.g., |2+-i| is illegal, but 
2+(-D| and |-1+2| are legal. 



Certain combinations of expression types 
and operators are illegal or have complex 
results. See Results of Dyadic Operator 
Combinations table on page 4-19. 

Some commands can accept a variety of 
argument types. The display block (DB) 
command accepts an integer, a range, or no 
argument at all. Other commands require 
that a certain argument type be used. The 
upload UPL command requires a range 
argument. See the discussion on Numbers, 
below, for types. 

If you have the symbolic debug option 
installed in your ESI 800 Emulator, you can 
use symbolic references. Every symbol 
must begin with a single quote ( Q ). 
Symbols are composed of 1 to 64 printable 
characters followed by a space or [return 1 . 
Symbols can be used anywhere a register or 
a number is used, with the exceptions that 
symbols are not valid with the colon 
operator or the repeat ( 0 ) operator. 
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Numbers The ESI 800 has a default base register. It is 

assumed that numbers entered without a 
leading base character are being entered in 
the default base. Generally, the default 
base is hexadecimal (factory default). See 
page 5-80 for more information on 
changing the default base register. 

There are three different types of numbers. 
An integer is a 32-bit signed value. 

A don't care is a 32-bit value with a 32-bit 
mask. For each bit set in the mask, the 
corresponding bit position in the value is 
ignored during Event Monitor comparisons. 
Don't cares can be entered in two ways. 



1234 dc offoI is explicit. |1XX41 is equivalent 



to Hff4 dc offoI. Don't cares are useful for 



setting the Event Monitor System event 
comparators (see page 7-2). 

The third number type is range. A range is 
specified by entering a start address and a 
length or an endpoint. [200 len 20] is the 



same as 1200 to 21f] . Ranges can be either 
internal (default) or external. An explicit 
range type can be specified by using the 
prefix IRA or XRA. |o len 100I is the same 
as I ira 0 len Tool . The |Tj operator inverts the 
type of a range value. |!(Q len iooTI is the 



same as xra 0 len 100L which means 



everything but addresses 1 to 00FF. The 
endpoints are always included in the range. 
Regardless of the method of entering (TO, 
LEN), range values are always displayed as 
"start TO end." 

Ranges, don't cares, and integers are not 
generally interchangeable. Certain registers 
can only hold certain data types. All 
registers can hold integers. Address type 
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registers cannot be loaded with don't care 
values. Status and data registers cannot be 
loaded with range values. See page 5-70 for 
a list of all registers and their data types. 

Base To enter a character in any base other than 

the default, use a leading base character: [%] 
= binary, 0 = octal, ® = decimal, and |] = 
hexadecimal. 



Expression List 



Assignment Command 



Lists are required by a few commands. 
They can also be used for implicit 
evaluation. For example, in pause mode, 
entering the three numbers 
%Q1 001 1010, #128, \77347] causes the Emulator 



to display their equivalent in the default 
display base (usually hexadecimal). Lists 
are limited to nine elements. Lists are used 
in memory and I/O modes as well. 

Svalues are the names of registers or 
symbolic references. The form 

laExpression = Expression) will cause the left 

side expression to be calculated and used as 
an address at which to store the value of the 
right side expression. Note that since 

itself an expression, 
are legal and 



laExpressionl IS 



commands such as |aass:sp =~o~ 
useful. 



Registers are grouped into three types: 
integer only, don't dare, and range. Any 
register can be assigned an integer value. 
Don't care registers can be loaded with 
don't care values or integers but not ranges. 
Range registers can be loaded with integers 
or ranges but not don't care values. See 
page 5-70 for a list of all registers and their 
data types. 
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The indirection operator [a] allows 
expressions to include values transferred to 
or from the target system memory address 
space. The expression becomes the address 
of a target system byte. 

In physical mode, more than one [sj operator 
in an expression displays a quantity pointed 
to by another quantity located in the target 
system memory. The Emulator evaluates 
the expression following the [a] operators, 
considers it an address, and looks at the 
value stored at this address. The value at 
this address is also considered to be an 
address. This address is accessed and 
displayed. 

Parentheses may be used to affect the 
processing of the [a] operator: 



>a GD4 + 6 
>a (GD4 + 6) 



In the first example the indirection operator 
is applied to [gd4]. The command interpreter 
accesses the target system location pointed 
at by [§D4], adds six to the value stored there, 
and displays the final results. 

In the second example, the Emulator 
displays the value stored in the sixth 
location above the address pointed to by 

[GD41 - 
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Memory mode always executes memory 
reads. This may be unacceptable for certain 
hardware configurations. To store values 
without entering memory mode, use: 



>a <acidress> = <ciata> 



This causes the system to load data into the 
specified address. 

Event Monitor System Event Monitor System statements describe 

Control Statement combinations of target program conditions 

and the corresponding actions to be taken if 
the conditions are met; they do not describe 
mathematical or logical computations. Be 
aware that normal expression operators are 
illegal when specifying Event Monitor 
System statements. These statements are 
discussed in detail in Section 7, Event 
Monitor System. 

Group The Event Monitor System (EMS) is 

arranged in four independent groups. 
These groups provide a state-machine 
capability for debugging difficult 
problems. An EMS control statement can 
only be associated with one of the four 
groups. If no group numbers are mentioned 
in the EMS control statement, the statement 
is assigned to group 1 . There are two ways 
to override this default selection of group 1. 
You can begin the EMS control statement 
with a group number, or you can append a 
group number to any one of the vent 
comparator names. For example: 
13 when aci then brk] is functionally the same 



as [when aci. 5 then brk| ; both use group 3. 
You cannot mix group numbers within a 
single EMS control statement. 
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Event 



Dis junctive 



You can define an event to be some 
combination of address, data, status, count 
and logic state probe conditions. Numerous 
Event Monitor System control statements 
can be entered and will be in effect 
simultaneously. Conflicting statements may 
cause unpredictable action processing. 
Parentheses are not allowed in event 
specifications. 

The NOT operator is used to reverse the 
sense of the comparator output. NOT has 
higher precedence than either of the 
conjunctives, AND and OR. 



WHEN AC1 AND NOT DC1 THEN BRK 



This statement means break whenever any 
data pattern other than that in DC1 is 
written to the address in AC 1 . 

Conjunctive AND and OR can be used where needed to 

form more restrictive event definitions. 
AND terms have higher precedence than 
OR terms. 



AC1 AND DC1 OR DC2 



This event is equivalent to [act and dci] in 
one statement and [dc2] in another. If you 
are looking for two different data values at 
an address, use: 



AC1 AND DC1 OR AC1 AND DC2 
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The OR operator is evaluated left to right 
and is useful for simple comparator 
combinations. For complex event 
specifications, OR combinations can be 
replaced with separate EMS control 
statements for clarity. 



AC1 AND S1 OR AC2 AND S2 



This even t is the same as |aci and si 1 and 



[AC2 and S2I in separate statements. 



Unary Operator All internal computations use 32-bit math. 

Values entered with a leading □ are 
converted to signed numbers; e.g., Q] is 
stored internally as isffffffffI . Internal 
math, however, is signe d only for the 0, □, 
B, E o perations; E5+J) is isfffffffeI , while 



l-i » 11 is reduced to |S7fffffff 



ABS converts a signed number to its 
absolute value. 

0 is a logical NOT operator and 
compliments all 32 bits of a number. If the 
number is a range, the range type (internal 
or external) is inverted. 

Unary op erato rs have the highest 
precedence. Fl^fl is 1 . 
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Operator The operators are listed below in 

descending order of precedence. Operators 
of the same type are evaluated left to right. 



Mul.op: 




* 


Multiply 


/ 


Divide 


MOD 


Modulo 


Add. op: 




+ 


Add 




Subtract 


Shft.op: 




» 


Right shift 


« 


Left shift 


& 


Logical AND 


A 


Logical OR 



Modulo The MOD operator. The result of this 

operation is the remainder after the value 
on the left has been divided by the value on 
the right. 



>29 MOD 4 
result = 1 
>38 MOD 6 
result = 2 
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Results of Single- Argument Operators 



Operator Argument Result 



■ 

1 


Integer 


Valid 




DC 


Don't care bits are not affected. 




IRA 


Complement (IRA becomes XRA) 


ABS 


Integer 


Valid 




DC 


Don t care bits are not affected. 




IRA 


Invalid 




XRA 


Invalid 




Integer 


Valid 




DC 


Don't care bits are not affected. 




IRA 


Invalid 




XRA 


Invalid 


@ 


Integer 


Valid 




DC 


Invalid 




IRA 


Invalid 




XRA 


Invalid 
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Results of Dyadic Operator Combinations 



Left Hand 
Expression 



Right Hand 
Expression 



Operator Result 



Integer 



Integer 



Integer 



Don't care 



Don't care 



IRA, XRA 



Integer 



Don't care 



IRA XRA 



Don't care 



Integer 



Integer 



* / MOD Valid 
& " Valid 
« » Valid 
+ - Valid 

MOD Illegal 

* / Don't care bits are passed to 

the left hand argument. 
& " Don't care bits are passed to 

the left hand argument. 
« >> Don't care bits are passed to 

the left hand argument. 

* / MOD Invalid 
& " Invalid 
« » Invalid 

+ - The endpoints of the range will 

be altered by the value of the 
integer expression. 

* / MOD Invalid 
& " Invalid 
« » Invalid 

+ - Don't care bits are ANDed. 

* / MOD Don't care bits are kept. 
<fc * Valid 

« >> Don't care bit positions are 

shifted. 

+ - Don't care bits are kept. 

* / MOD Invalid 
<fe * Invalid 
« » Invalid 

+ - The end points of the range 

will be altered by the value of 
the integer expressed. 
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Help 

There are two pages of help information available. Enter a 0 as the first 
character of a command line to display the first help page. This page gives 
examples of the most commonly used commands and their meanings. The 
second page desc ribes the Event Monitor System registers and commands. 
Enter a IreturnI at the end of the first page to move to the second page. 
The menus are shown on the next two pages. 

Information on switch settings, configuration settings, and special 
functions is available without using the help menus. Other help menus are 
described below. 



Software Switches 



Enter either [on] or [off] to display the 
current settings and definitions of all 
software switches, (see page 5-9). 



Communications 
Set-up 



Special Diagnostic 
Functions 



Enter [set] to display the current 



configuration settings and possible values 
(see page 5-3). 

Enter [sf] to display a list of the available 
special functions (RAM/ROM tests, Scope 
loops, etc.) (see page 6-50). 
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First Page of Help Menu 



>? 

RUN/EMULATION: 
STP - SINGLE STEP/STOP 
RST - RESET TARGET SYSTEM 

TRACE HISTORY: 
DT - DISASSEMBLE MOST RECENT LINE 

MEMORY - REGISTER COMMANDS: 
DB X TO Y - DISPLAY BLOCK 
BMO X TO Y,Z - BLOCK MOVE TO Z 
MMS = ALT, COD, DAT, STA 
X - EXIT MEMORY MODE 

MEMORY MAPPING: 
MAP X TO Y :RO :RW :TGT :ILG 

COMMUNICATIONS: 
DNL - DOWNLOAD HEX FILE FROM HOST 
UPL X TO Y - UPLOAD HEX TO HOST 



RUN/RNV - RUN/RUN WITH NEW VECTORS 
RBK/RBV - RUN TO BREAKPOINT/WITH VECTORS 
WAIT - WAIT UNTIL EMULATION BREAK 

DTB/DTF -DISASSEMBLE PAGE BACK/FORWARD 
DRT (X) -DISPLAY PAGE RAW TRACE (FROM X) 

DR - DISPLAY ALL CPU REGISTERS 
FILL X TO Y,Z - FILL BLOCK WITH Z 
LOV/VFO X TO Y - LOAD/VERIFY OVERLAY 
DEFINES STATUS LINES FOR MEMORY ACCESS 
M X - VIEW/CHANGE MEMORY AT X 

OVE = CD, DAT 

DM/CLM - DISPLAY/CLEAR MEMORY MAP 

TRA - TRANSPARENT MODE TERMINAL- HOST 
CCT - TRANSFER CONTROL TO COMPUTER PORT 
TCT - TRANSFER CONTROL TO TERMINAL PORT 



SYSTEM: 

ON/OFF - VIEW/ALTER SWITCHES 
ASM (X) - IN LINE ASSEMBLER 
LD/SAV (X) - LOAD/SAVE 0=SETUP,1- 



SET - VIEW/ALTER SYSTEM PARAMETERS 
SF - VIEW/EXECUTE SPECIAL FUNCTIONS 
DIS(X) DISASSEMBLE FROM MEMORY 
iS,2-EVENTS,3=MAP,4=SWITCHES,5=MACROS 
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Second Page of Help Menu 



EVENT MONITOR SYSTEM 

DES - DISPLAY ALL EVENT SPECIFICATIONS 

CES - CLEAR ALL EVENT SPECIFICATIONS 

DES X - DISPLAY ALL EVENT SPECIFICATIONS FOR GROUP X 

CES X - CLEAR ALL EVENT SPECIFICATIONS FOR GROUP X 

EVENT ACTIONS: 

BRK - BREAK CNT - COUNT EVENT TGR - TTL TRIGGER STROBE 

TRC - TRACE EVENT RCT - RESET COUNTER FSI - FORCE SPECIAL INTERRUPT 

TOT - TOGGLE TRACE TOC - TOGGLE COUNT GROUP X - SWITCH TO GROUP X 

EVENT DETECTORS - GROUPS 1,2,3,4: 

AC1,AC2 OR AC1.X,AC2.X - 24 BIT DISCREET ADDRESS OR INTERNAL EXTERNAL RANGE 
DC1,DC2 OR DC1.X,DC2.X - 16 BIT DATA, MAY INCLUDE DON'T CARE BITS 
S1,S2 OR S1.X.S2.X - STATUS AND CONTROL - BYT/WRD + RD/WR + TAR/OVL 

- + MEM/ I OA + IAK/RIO/WIO/HLT/IF/RM/WM/NBC 

- + ALT/COD/DAT/STA 

LSA - 16 LOGIC STATE LINES, MAY INCLUDE DON'T CARE BITS 

CTL - COUNT LIMIT, ANY NUMBER 1 TO 65,535 



STEP 1 - ASSIGN EVENT DETECTORS 

AC1 = $1234;S1 = BYT + RM 

AC1.2 = $4576+14*6;DC2.2 = $5600 DC $FF 

CTL. 2 - 24;AC2.2 = $F000 LEN $400 



STEP 2 - CREATE EVENT SPECIFICATIONS 
WHEN AC1 AND S1 THEN GROUP 2 
2 WHEN AC1 AND NOT DC2 THEN CNT 
WHEN CTL. 2 OR AC2.2 THEN BRK 
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Prompts 



Different prompts are displayed depending on the current operating mode 
of the ESI 800. 



> 



R> 



$12345678 $00 > 
$12345678 $00 R> 
$12345678 $0000 > 
$12345678 $0000 R> 



The standard, or pause mode, prompt from 
ESL consists of a space character followed 
by a right arrow. 

During emulation, the run mode prompt is 
displayed. Most ESL commands are still 
valid. 



In memory mode, the prompt includes the 
memory address and the data contained 
there. Depending on whether byte mode or 
word mode (BYM, WDM) has been chosen, 
the data will be a byte or a word. The run 
prompt may also be present during memory 
mode. 



**** 8086/88/ 186/ 188 LINE ASSEMBLER V2.6LA**** 
CSEG = 0000 
0100 > 



The line assembler displays a 16-bit address 
prompt. This prompt contains an [r] if you 
are assembling during emulation. 



IO:$1200 > 
IO:$1200 $00 > 
IO:$1200 $0000 > 
IO:$1200 R> 
IO:$1200 $00 R> 
IO:$1200 $0000 R> 



In I/O mode, the prompt includes the I/O 
address. The data is included when a 
1 return] is entered as the only character on 
the line. The data field is affected by byte 
and word mode. If emulating, the run 
prompt will also be present. 
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Special Modes 

There are a few special modes you can enter, some of which must be exited 
before using regular ESL commands. These modes can be identified by the 
prompt displayed, or lack thereof. 



Byte Mode/ 
Word Mode 



Line Assembler 



Memory Disassembler 



Memory Mode 
I/O Mode 
Transparent Mode 



The BYM and WDM commands select byte 
or word mode operation. The mode 
selected determines whether 8- or 16-bit 
data is used or displayed. If byte mode is 
set, most data commands use byte values, 
and the indirection operator reads a byte 
from the address given. The same is true of 
word mode. 



The line assembler has a single 16-bit 
address prompt. Exit by entering an [x] or 
the END directive. 

If initiated without a range argument, the 
memory disassembler (DIS) displays a full 
page of data, leaving the cursor at the lower 
right corner of the screen. A | return | 
displays the next page of disassembled 
memory. A |space| causes only the next 
instruction to be disassembled. Any other 



character terminates memory disassembly. 

Memory mode has an address and data 
prompt. Exit by entering an [x]. 

I/O mode has an address prompt. Exit by 
entering an [x]. 

No characters are generated by the ESI 800. 
Exit by entering the two- character escape 
sequence (default is [esc] [esc] ), or reset 
(default IctrlI [z] ). 
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Special Characters 



DELETE 
BACKSPACE 



CTRLX 
CTRLR 
CTRLZ 



ESC ESC 



CTRLS 



CTRL Q 



Either character deletes a character just 
entered on a command line. 

Deletes an entire command line. 

Redisplays the current command line. 

The default system reset character. Resets 
the Emulator, stops emulation and/or clears 
an error condition. It does not clear or 
update Emulator registers. Used to 
terminated certain diagnostic functions. 
CTRL Z terminates an indefinitely 
repeating command. You can change the 
reset character (see page 5-3). 

The default transparent mode escape 
sequence, which terminates transparent 
mode. You can change the transparent 
mode escape sequence (see page 5-3). 

The default XOFF character. When issued 
from the keyboard, the screen display stops 
scrolling, allowing you to see the 
information. You can change the XOFF 
character (see page 5-3). 

The default XON character. Restarts the 
screen display scrolling after an XOFF is 
issued. You can change the XON character 
(see page 5-3). 
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Errors 



The ESI 800 software generates two basic types of error messages. ES 
Language Syntax and operational errors in a command line are indicated 
by a beep (BEL code). The next line displayed contains a single [?] 
underneath, and usually just after, the place in your command line that 
caused the error. At the point the error is detected, the remainder of the 
command line is discarded. For example, the DRT command is invalid 
during emulation: 



>WHE AC1 THE BRK; RBK; DRT; DR 
<BEL> ? 
R> 



The RBK command was executed, but the DR command was not. 
Whenever you see an error message of this type, you can enter a single \t\. 
The ESI 800 responds with a text message explaining the error. For the 
above example: 



R>? 

ERROR #56 

TRACE DATA IS INVALID DURING EMULATION 
R> 



These error messages are described in this section. The second type of 
error message is caused by target hardware problems. There are various 
conditions that can occur in the target that prevent the pod processor from 
operating. If these error messages are displayed, the problem must be 
remedied before the ESI 800 can be used. The error messages are quite 
explicit: e.g., [no target clock) or |reset asserted] . Target hardware error 
messages are explained in Appendix B. 
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ES Language Error Messages 

1,2,3 EXPRESSION HAS NO MEANINGFUL 

RELATION TO REST OF COMMAND. 
Often caused by entering symbols out of 
context, [drj and [brk] are both legai, but 
when entered together as |dr brk| would 
cause this error message. 

5 UNDEFINED SYMBOL OR INVALID 

CHARACTER DETECTED. Usually 
caused by improper spelling. 

6 CHECKSUM ERROR IN DOWNLOAD 

DATA. The last record received was in 
error. Make sure that the format selected in 
the system set-up is the same as the format 
of the received data. Refer to download 
command (DNL) for error handling. 

7 BAD STATUS = ...RETURNED FROM 

EMULATOR CARD. Contact Customer 
Service for ES Products. 

8 ARGUMENT IS NOT A SIMPLE 

INTEGER OR INTERNAL RANGE. 
Don't cares are not allowed in this context. 

9 NO MORE OVERLAY MEMORY 

AVAILABLE. You have not cleared the 
map or you are trying to map in more 
memory than is allowed. Contact Applied 
Microsystems for optional overlay memory 
expansion. 

10 MULTIPLE- DEFINED EVENT GROUP. 

Only one group may be referenced in any 
event clause. Error is caused by trying to 
mix event register groups in an event clause 
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(e.g., \2 when Ad .3 then brk| would cause this 
error). 

11 ILLEGAL ARGUMENT TYPE FOR 

EVENT SPECIFICATION. Only the 8 
event comparators may be used in the event 
portion of a WHEN/THEN statement. 

12,13 ARGUMENTS MUST BE A SIMPLE 

INTEGER. Don't care masks and ranges 
not allowed. 

14,15,16 OPERATION INVALID FOR THESE 

ARGUMENT TYPES. Usually caused by 
attempting arithmetic operations on 
incompatible variables (e.g., 
K4 dc 9) + (ira 500 to 700))] . (Same as error 
23.) 

17 SHIFT ARGUMENT CANNOT BE 

NEGATIVE. To shift a value in the reverse 
direction, use the opposite shift operator, 
EE o r ElL not a negative shift value. 

18 TOO MANY ARGUMENTS IN LIST ... (9 

MAX). When entering data in memory or 
I/O mode, a list of only 9 values can be 
entered on a single command line. 

19 INVALID GROUP NUMBER . . . (NOT IN 

1-4). There are only four event groups 
(1-4). 

20,21,22,23 OPERATION INVALID FOR THESE 

ARGUMENT TYPES. Often caused by 
attempting arithmetic operations on 
incompatible variables. 
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BASE ARGUMENT MUST BE A SIMPLE 
INTEGER. Argument should be #0 to #16. 

RANGE TYPE ARGUMENT NOT 
ALLOWED AS DATA. Data can only be 
expressed as masked values or integers. 

ADDRESS ARGUMENT MUST BE A 
SIMPLE INTEGER. Cannot use ranges or 
masked values. 

ILLEGAL DESTINATION - SOURCE 
TYPE MIX. Caused by trying to store don't 
care data into a range variable or other 
similar operations. 

RANGE START AND END 
ARGUMENTS MUST BE SIMPLE 
INTEGERS. Cannot use masked values or 
ranges. 

RANGE END MUST BE GREA TER 
THAN RANGE START. 16 Len i| and 
10 to 51 are examples of invalid ranges. 

RANGE START AND END 
ARGUMENTS MUST BE SIMPLE 
INTEGERS. Cannot use masked values or 
ranges. 

READ AFTER WRITE-VERIFY ERROR. 
Data supposedly written to memory during 
a download operation was read back as a 
different value. The error message contains 
the locations and results of the comparison. 

WARNING - DATA WILL BE LOST 
WHEN EMULATION IS BROKEN. 
Caused by assigning values to CPU registers 
during emulation. CPU registers are copied 
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into internal RAM only when emulation is 
broken. The RAM contents are copied into 
the processor only when emulation is 
begun. The Emulator cannot access CPU 
registers during emulation. Thus, once 
emulation has been started the DR 
command shows the contents of the CPU 
registers as they were before emulation was 
begun. Changes can be made to these 
values, but the data will be rewritten when 
emulation is broken. 

36,37,38 NO ROOM . . . BREAKPOINT CLAUSES 

TOO NUMEROUS OR COMPLEX. Too 
many WHEN/THEN clauses were entered. 

39 INVALID GROUP NUMBER . . . (NOT IN 

1-4). There are only four groups in the 
Event Monitor System. 

40 ILLEGAL SELECT VALUE. Variable 

cannot be assigned value specified. Check 
manual. 

41 INCORRECT NUMBER OF 

ARGUMENTS IN LIST. Check command 
argument list. 

42 ILLEGAL SETUP SET VALUE. Consult 

SET menu for legal values (page 5-3). 

43 "WHEN" CLAUSE REDUCED TO NULL 

FUNCTION. Caused by constructs such as 

|AC1 AND NOT AC 1 j . 

44 INTERNAL ERROR . . . NULL SHIFTER 

FILE. Contact Customer Service for ES 
Products. 
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45 MAP CANNOT BE ACCESSED DURING 

EMULATION. The map hardware is 
constantly used by the emulating processor 
during emulation and cannot be accessed. 

46 ARGUMENT MUST BE AN INTERNAL 

RANGE. External ranges and masked 
values not allowed. 

47 16-BIT RANGE END LESS THAN 

START. Invalid range. 

48 ILLEGAL MODE SELECT VALUE. 

49,50 INVALID GROUP NUMBER . . . (NOT IN 

1-4). Must be 1 through 4. 

51 SAVE/LOAD INVALID ARGUMENT 

VALUE. Valid arguments include 0 
through 5. 

53 EEPROM WRITE VERIFY ERROR. Data 

in the EEPROM is verified during the SAV 
operation. (The store operation is retried 
many times before this error is generated.) 
EEPROMs have a finite write cycle life. 
The EEPROM in your Emulator is 
warranted for one year. Contact Applied 
Microsystems for service. 

54 ATTEMPT TO SAVE/LOAD DURING 

EMULATION. These commands may only 
be used while in the pause mode. 

55 EEPROM DATA INVALID DUE TO 

INTERRUPTED SAVE. Previous SAV 
command was interrupted by a reset or 
power off. 
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56 TRACE DATA IS INVALID DURING 

EMULATION. Viewing of the trace is 
only allowed during pause mode. 

57 (INVALID GROUP NUMBER (NOT 1-4). 

Must use 1-4. 

58 IMPROPER NUMBER OF ARGUMENTS. 

Check command argument list. 

59 ARGUMENT MUST BE AN INTERNAL 

RANGE. External ranges and masked 
values not allowed. 

60 ARGUMENT MUST BE A SIMPLE 

INTEGER. Ranges and don't care masks 
not allowed. 

61 IMPROPER NUMBER OF ARGUMENTS. 

See error 58. 

62 CANNOT STORE THIS VARIABLE 

DURING EMULATION. Must be in pause 
mode. 

63 ILLEGAL ARGUMENT TYPE. 

64 ARGUMENT TOO LARGE. Caused by 

entering DRT argument that includes 
numbers greater than #2045. 

65 ILLEGAL RANGE. 

66 STATUS CONSTANTS CANNOT BE 

ALTERED. System constants (e.g., BYT, 
OVL) cannot be assigned values. 
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67 



TOO MANY "WHEN" CLAUSES. You 
have tried to enter more WHEN/THEN 
clauses than the Event Monitor System can 
handle. 



68 



INVALID DATA FORMAT FOR 
SYMBOLS. Must use Extended Tektronix 
Hex. 



70 



CANNOT INITIALIZE 



71 



72 



74 



75 



76 



78,79,80 



81 



DURING EMULATION, pv, rnv 



VECTORS 
and 



rbv| can only be entered in pause mode. 



UNKNOWN EMULATOR ERROR. 
Applied Microsystems. 



Call 



INCOMPATIBLE EEPROM DATA. 
Previous data saved to EEPROM was not 
from an 80186/88 Emulator system. 

COMMAND INVALID DURING 
EMULATION. Must be in pause mode. 

INVALID RECORD TYPE. Download 
routine received invalid record type code. 

NO SYMBOLIC DEBUG. The symbolic 
debug option is not installed in your system. 
Cannot assign symbol and section values. 

TOO MANY SYMBOLS. Symbols 
exceeded available RAM. Purge symbols 
before downloading again. 

SYMBOL OR SECTION PREVIOUSLY 
DEFINED. You must delete a section 
before assigning it a new value. 
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82 SYMBOL NAME IN USE. Symbol name 

cannot be used more than once. 

83 TYPE CONFLICT WITH DEFINED 

SYMBOL. Please refer to Extended Tek 
specification. 

87 SECTION TABLE FULL. Too many 

symbolic section names have been defined. 

88 INVALID ARGUMENT SIZE. Operand 

doesn't fit into destination register. 

89 INVALID ADDRESSING MODE. 

90 ARGUMENT OUT OF RANGE. Usually 

caused by reference to a "FAR" location 
without declaring "FAR." 

91 INVALID TRAP VECTOR NUMBER. 

93 INVALID CONTROL REGISTER. 

94 ARGUMENT NOT SYMBOLIC. Requires 

a symbolic argument. 
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SYSTEM COMMANDS 



Setup Commands 

The SET and ON/OFF commands allow you to configure the ESI 800 
according to hardware and debugging needs. There are two menus 
containing variables that are software selectable for quick and easy 
changes. 

The SET menu contains all of the external communication variables such 
as baud rates, parity, and upload/download data format. Some set 
parameters require a reset before becoming effective. You can also set the 
serial communication parameters and save them to EEPROM without 
affecting the parameters currently in use. 

The ON/OFF menu contains switches that control emulation and the serial 
port copy switch. For example, you can run the Emulator without a target 
system by using the Emulator-supplied clock signal, an Emulator- 
generated ready signal and overlay memory. The copy switch copies data 
to both serial ports for obtaining hard copy of your emulation session. 

The SET menu and the ON/OFF menu can be saved to EEPROM after you 
have set them. These values may then be automatically loaded into the 
Emulator on power-up by setting the thumbwheel switch to the 
appropriate value, or manually by typing a load command (LD) to the 
Emulator after power-up. 



5-1 



ES1800 Emulator Reference Manual for 80186/188 Microprocessors 



The EEPROM is divided into two groups of six sections. Each section 
within a group may be loaded and saved individually. The two groups 
designate two users, referred to as user 0 or user 1 in the SET menu. This 
allows two users to save complete information about their emulation 
session, and reload it later. The six sections of information are: 



Group # 



Description 



0 
1 
2 
3 
4 
5 



SET menu 
Registers 

Event Monitor WHEN/THEN clauses 
Overlay map 
ON/OFF menu 
Macros 
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Command Result 



Displays the SET menu. The 
parameters in this menu specify 
the external communication 
details. 



>SET 




ES SETUP: 


SEE MANUAL FOR DETAILS... 


SET #X,#Y 


- SET ITEM X TO VALUE CORRESPONDING TO Y 


LD 0;SAV 0 LOAD/SAVE SETUP FOR CURRENTLY SELECTED USER 


SYSTEM: 


#1 USER = 0; [0,1] 




#2 RESET CHAR = $1A 




#3 XON, XOFF = $11, $13 


TERMINAL: 


#10 BAUD RATE = #14; [2=110,5=300,10=2400,14=9600] 




#11 STOP BITS = 1 [1,2] 




#12 PARITY = 0; [0=NONE, 1=EVEN,2=ODD] 




#13 CRT LENGTH = #24 




#14 TRANSPARENT MODE ESCAPE SEQUENCE = $1B,$1B 


COMPUTER: 


#20 BAUD RATE = #14; [7=1200,12=4800,15=19200] 




#21 STOP BITS = 1 




#22 PARITY = 0 




#23 TRANSPARENT MODE ESCAPE SEQUENCE = $1B,$1B 




#24 COMMAND TERMINATOR SEQUENCE = $0D,$00,$00 




#25 UPLOAD RECORD LENGTH = #32; [1 to 127] 




#26 DATA FORMAT = 0; [0=INT,1=MOS,2=MOT,3=SIG,4=TEK,5=XTEK] 




#27 ACKNOWLEDGE CHAR = $06 
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SET <parameter>, <exp> 



The value of the specified 
parameter is changed to <exp>. 
If you assign an illegal value to a 
variable, an error message is 
displayed, and the value is not 
changed. 



Comments 



The table below shows the valid values for each SET variable. All 
arguments preceeded with a [§ indicate that the value entered must be a 7- 
bit ASCII character. 

The H preceding the SET command arguments below is typed in and 
designates the value entered as decimal. The @ is optional for decimal 
numbers 0-9. 



Parameters Description Reset Required 



SET#1,#0 UserO No 
SET#1,#1 User 1 No 



Two users may save and load values to the EEPROM. 
This parameter indicates which user is active when 
executing the SAV and LD commands. 



SET#2,$n 



Reset character 



No 



The reset character resets the Emulator and the pod 
CPU. The system default is CTRL Z ($1 A). 



SET #3,$n,$m 



XON/XOFF characters No 



XON and XOFF control the screen scrolling. An 
XOFF stops a scrolling display. XON resumes scrolling 
the display. The system defaults are CTRL Q, CTRL S 
($13, $11). 
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Parameters Description Reset Required 



SET#10,#1 75 baud Yes 

#2 110 baud 

#3 134.5 baud 

#4 150 baud 

#5 300 baud 

#6 600 baud 

#7 1200 baud 

#8 1800 baud 

#9 2000 baud 

#10 2400 baud 

#11 3600 baud 

#12 4800 baud 

#13 7200 baud 

#14 9600 baud (default) 

#15 19200 baud 

The terminal port baud rate 

SET # 1 1 ,# 1 1 stop bit (default) Yes 

#2 2 stop bits 

The number of stop bits for the terminal port 

SET #12,#0 No parity (default) Yes 

#1 Even parity 

#2 Odd parity 



The parity for the terminal port 



SET#13,#n CRT length (default: 24 lines) No 

The maximum number of lines displayed for 
commands that use paging 
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Parameters Description Reset Required 



SET#14,$n,$m Transparent mode 

escape sequence No 

When entered from either port, transparent mode is 
terminated. The default sequence is ESC, ESC 
($1B,$1B). 

SET#20,#1 75 baud Yes 

#2 110 baud 

#3 134.5 baud 

#4 150 baud 

#5 300 baud 

#6 600 baud 

#7 1200 baud 

#8 1800 baud 

#9 2000 baud 
#10 2400 baud 
#11 3600 baud 
#12 4800 baud 
#13 7200 baud 
#14 9600 baud (default) 
#15 19200 baud 

The computer port baud rate 

SET #21,#1 1 stop bit (default) Yes 
#2 2 stop bits 

The number of stop bits for the computer port 

SET#22,#0 No parity (default) Yes 
#1 Even parity 
#2 Odd parity 



Parity for the computer port 
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Parameters Description Reset Required 



SET #23,$n,$m Transparent mode 

escape sequence No 

When entered from the computer port, transparent 
mode is exited. The default sequence is ESC, ESC 
($1B,$1B). 

SET #24,$n,$m,$o 

Command terminator sequence No 



The default sequence is 1 return L null, null (SOD, $00, 
$00). 

SET #25, #n Upload record length No 

The maximum length for an upload record. (The 
default length is 32 bytes of data.) 

SET#26,#0 Intel (default) No 

#1 MOS 

#2 Motorola 

#3 Signetics 

#4 Tektronix 

#5 Extended Tekhex 

Upload/download serial data format 

SET #27, $n Acknowledge character No 

The acknowlege character is sent when a valid record is 
received when downloading in computer control. The 
default is $06. 
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SET COMMAND (cont. ) 



Comments 



Some SET parameters require the system to be reset, and prompt for a reset 
character. If you change a parameter that requires a reset, but do not enter 
one, subsequent displays of the SET menu show the new value you have 

"ctSSigilcu uic vaxiauic, even uiuugn 11 is uui vuncuu) ah hi^i. 

If you change the SET parameters and wish to use the new values at a later 
date, you can save them in EEPROM by entering a SAV or SAV 0 
command. 

Saved parameters can be loaded automatically at power-up or manually 
after the system is up and running. To load automatically, set the 
thumbwheel switch (see page 3-5) before turning on the Emulator. To 
load manually, enter LD (to load all variables and settings) or enter the LD 
0 command (to load just the SET parameters). 

See Serial Communication (page 5-29) for information on communicating 
with a host computer. 
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Command 



Result 



ON 
OFF 



Displays the ON/OFF menu. 



Displays the ON/OFF menu. 



>0N 






ES 


SWITCH 


SETTINGS 


LD/SAV 4: LOAD/SAVE SWITCH SETTINGS IN EEPROM 


EXAMPLES: >0N 


BKX+CK 




>OFF 


FSX+CPY 


VALUE 


NAME 


DESCRIPTION 


OFF 


BKX 


BREAK ON INSTRUCTION EXECUTION (NOT PREFETCH) 


ON 


CK 


SELECT INTERNAL CLOCK 


OFF 


CPY 


COPY DATA TO TERMINAL & COMPUTER PORTS 


ON 


FSX 


FSI ON INSTRUCTION EXECUTION (NOT PREFETCH) 


ON 


RDY 


SELECT INTERNAL READY WHEN ACCESSING OVERLAY 


ON 


ST I 


ENABLE STEP THROUGH INTERRUPTS 


OFF 


DME 


ENABLE DMA DURING PAUSE 


OFF 


TEO 


ENABLE TIMER 0 DURING PAUSE 


OFF 


TE1 


ENABLE TIMER 1 DURING PAUSE 


OFF 


TE2 


ENABLE TIMER 2 DURING PAUSE 


OFF 


RCS 


ENABLE CHIP SELECT REGISTERS DISPLAY 


OFF 

> 


CDH 


CLEAR DHLT BIT IN 1ST REGISTER ON PAUSE TO RUN 



ON <switch> 



Sets the specified switch to the 
ON position. 
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SWITCH SETTING (cont.) 



OFF <switch> Sets the specified switch to the 

OFF position. 



Comments 



Some ON/OFF switches cannot be set during run mode. 

The arguments to the ON and OFF commands are the names of the 
switches themselves. These are: 



BKX 


Break on instruction execution 


CDH 


Clear DMA halt 


CK 


Internal/external clock 


CPY 


Copy data to both serial ports 


DME 


Enable DMA 


FSX 


Force special interrupt on instruction execution 


RCS 


Read chip select control registers 


RDY 


Internal/external ready signal 


STI 


Step through interrupts 


TE<0,1,2> Timers 



You may turn on or off multiple switches by listing them with a 0 between 
their names. 

All switches can be turned off with the command OFF - 1 . 

You can save all of the current switch settings in EEPROM for later use by 
executing a SAV (to save all variables and settings) or SAV 4 (to save just 
switch settings) command (see page 5-25). 

The saved switches can be loaded automatically at power- up or manually 
after the system is up and running. To load automatically, set the 
thumbwheel switch (see page 3-5) before turning on the Emulator. To 
load manually, enter a LD (to load all variables and settings) or LD 4 (to 
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SWITCH SETTING (cont.) 



load just the switch settings) command (see page 5-27). 



Examples 



If you want a hard copy of an emulation session, attach a printer to the 
computer port on the back chassis of the Emulator. Turn on the copy 
switch so that all data is copied to both serial ports. 



>0N CPY 

> 



Assume that you are debugging a program on a new piece of hardware. 
The program has already been debugged using the Emulator's overlay 
memory and appears to be functioning properly. When you try to run the 
program in the hardware it does not work correctly. In this case you may 
want to switch back and forth between running from overlay memory and 
the target. When running out of overlay you want to use an internal clock 
and ready signal. You do this with these two commands: 



>0N RDY+CK 
>OFF RDY+CK 



Here are two alternative methods for doing the same thing using fewer 
keystrokes. 

The first is to use a general purpose register for the command parameter. 
Assign the register the switch names. Then use the register as the 
parameter for the commands. 



>GR0 = RDY+CK 

>0N GRO 
>OFF GRO 
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SWITCH SETTING fcont.) 



The next way is to use two macros for the commands. Assign macros 1 and 
2 to the ON and OFF commands. Execute these macros by typing a [7] and 
□ as the first character on each line (see page 5-104). 



>_1=ON RDY+CK 
> 2=OFF RDY+CK 



>. 
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BREAK ON INSTRUCTION EXECUTION 



Command Result 



ONBKX The Event Monitor System 

breaks on the execution of the 
instruction rather than the 
instruction pre-fetch. 

OFF BKX The Event Monitor System 

breaks whenever an address is 
seen on the bus. 

Default: OFF 



Comments 



The 80186/88 prefetches instructions. Because of this, an address can be 
detected on the address bus before the instruction is actually executed. If 
you set a breakpoint on an address that immediately follows a branch, the 
Emulator may break before the instruction is executed (it was prefetched). 
Set this switch to force the break to occur only on address execution. 
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CLEAR DMA HALT 



Amnion^ Vacul-f 



ONCDH DMA is reenabled during 

pause-to-run. 

OFF CDH During pause-to-run, DMA 

status is unchanged from status 
while paused. 

Default: OFF 
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INTERNAL/EXTERNAL CLOCK 



Command 



Result 



ON CK 



The CPU uses an internally 
generated clock. This is a 
nonadjustable clock set at 12.5 
MHz (CPU speed). 



OFF CK 



The CPU uses the target system 
clock. 



Default: OFF 



Comments 



This command is valid only in pause mode. 

Use an internal clock when debugging code before target hardware is 
available. Download the program to overlay memory. Turn on the 
internally generated ready signal and clock (ON RDY and ON CK) and 
begin debugging. 

See also the Download command, page 5-38 the overlay memory section, 
page 5-54 and the RDY switch, page 5-20. 
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COPY DATA TO BOTH PORTS 



Command Result 



ONCPY Sends all data to both the 

terminal and computer ports. 
Data sent to the controlling port 
is echoed to the other port 
(noncontrolling port). 

OFFCPY Only sends data from the 

Emulator to the controlling 
port. 

Default: OFF 



Comments 



This provides a way to make a hard copy of emulation data. It is also 
useful for monitoring computer control commands. 

See Serial Communications, page 5-29 for more information on the 
terminal and computer ports. 
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ENABLE DATA 



Command 



Result 



ON DME 



The DMA controllers are active 
during pause. The values in 
DMAO and DMA1 registers are 
not reloaded to the physical PCB 
upon pause-to-run. The 
following also occurs: 

On a run-to-pause transition 
the 1ST register is copied to the 
internal RAM table. The DHLT 
bit is then cleared, causing 
DMA cycles to resume. All 
DMA cycles are directed to the 
target system. 



OFF DME 



The DMA controllers are 
active during pause mode. 

Default: OFF 



not 



Comments 



All DMA cycles are disabled immediately upon a run-to-pause transition. 

If the target system uses an external dynamic memory controller for 
refresh, DME must be set to OFF. This prevents memory read signals 
from going out to the target in pause mode. 

If internal DMA is used, then DME should be ON. 
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FSI ON INSTRUCTION EXECUTION 



Command 



Result 



ON FSX 



An Event Monitor System 
forced special interrupt (FSI) 
occurs when an instruction is 
executed. Refer to page 7-25 
for the FSI command. 



OFF FSX 



Forced special interrupt (FSI) 
occurs when an address is seen 
on the bus. 



Default: ON 



Comments 



The 80186/88 prefetches instructions. Because of this, an address can be 
detected on the address bus before the instruction is actually executed. If 
you set an FSI on an address that immediately follows a branch, the 
Emulator may execute the FSI before the instruction is executed (it was 
prefetched). Set this switch to force an FSI to occur only on address 
execution. 
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READ CHIP SELECT 



Command Result 



ON RCS All chip select control registers 

are read upon run-to-pause. 

OFF RCS The chip select control registers 

are only read and loaded to the 
internal RAM table if they have 
been set manually with a value 
during pause mode. 

The transition from pause to run 
mode causes only those chip 
select registers that have been 
modified during pause mode to 
reload to the physical PCB. The 
displayed values of chip select 
registers do not show what is 
actually in the PCB. 

Default: OFF 



Comments 



The RCS software switch does not affect the UMCS chip select control 
register. 

Reading the chip select control registers enables their corresponding 
outputs. Use the RCS software switch only after the chip select control 
registers are set. 
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INTERNAL/EXTERNAL READY SIGNAL 



^nmmnnrl Result 



ON RDY Selects an internally generated 

ready signal to complete 
memory accesses. This allows 
use of overlay memory when no 
target system is being used. 

OFF RDY Selects the target system's ready 

signal to complete memory 
accesses. 

Default: OFF (See note below.) 



Comments 



This command is valid only in pause mode. 

A "ready signal" denotes the end of a memory cycle. See the Intel iAPX 
86/88, 186/188 Users Manual for details. 

If overlay memory is mapped in an area where target memory is 
nonexistent, the target decode logic may not provide a ready signal. An 
ON RDY provides this signal, allowing overlay memory to be used in those 
areas. 

When the ready switch is on and the target system is also providing a ready 
signal, the first ready signal back to the Emulator will be the one used. 

If internal ready is selected and there is a target, there is no 
synchronization between the ready signal and the target hardware. This 
can cause problems if a ready is returned by the Emulator before the target 
hardware is ready. 



5-20 



INTERNAL/EXTERNAL READY SIGNAL (cont.) 



NOTE: Default is ON if there is no target clock on power-up and if 
internal clock has been selected. 
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STEP THROUGH INTERRUPTS 



V 111 111 M.S.M V* 



Paciilf 



ON STI 



The Emulator recognizes an 
interrupt and steps through the 
interrupt service routine. 



OFF STI 



The Emulator ignores interrupts 
while stepping through a 
program. 



Default: OFF 



Comments 



Stepping through code is a common way to locate software bugs. This 
switch allows you to ignore interrupts while debugging higher level 
routines, or to step through and debug the interrupt routine itself. 

See also the Step command (STP) on page 6-7. 



5-22 



TIMERS 



Command 



Result 



ON TE<0, 1,2> 



The specified PCB timer (0,1 or 
2) is active during pause mode. 
The transition between 
emulation modes executes as 
follows: 



>RUN TO PAUSE 



The value in the specified timer 
register is loaded to internal 
RAM and can be modified 
using a |<reg> = 
command. 



<value> 



>PAUSE TO RUN 



The value in the internal RAM 
table of the specified timer is 
not loaded. Reloading this 
value destroys the data 
generated during pause mode. 



OFF TE<0,1,2> 



The specified PCB timer (0,1,2) 
is not active during pause mode. 
The transition between 
emulation modes executes as 
follows: 
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TIMERS (cont.) 



RUN TO PAUSE 



The mode control word register 
(MCWO, MCW1, MCW2) for the 
specified timer is loaded to the 
internal RAM table. The timer 
is then disabled by clearing bit 
15 of the mode control word 
register. 



PAUSE TO RUN 



The value in the internal RAM 
table of the specified timer is 
reloaded to the physical PCB. 
This restores the timer to its 
configuration when last running 
in the target system. 

Default: OFF 
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SAVE SYSTEM VARIABLES IN EEPROM 



Command 



Result 



SAV 



Copies all system variables from 
Emulator memory into 



EEPROM. 



SAV <category> 



Saves one of the six categories 
of variables from Emulator 
RAM to EEPROM. 



Comments 

This command is valid only in pause mode. 
A SAV operation may take up to two minutes. 
DO NOT INTERRUPT THE PROCESS! 

Values saved to EEPROM continue to be valid within the Emulator. 

There is room in EEPROM to save the system variables for two different 
users. The user is determined by a parameter in the SET menu. When you 
execute a SAV, the variables are saved to the user partition currently 
defined in the SET menu. 



( continued ) 
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SAVE SYSTEM VARIABLES IN EEPROM (cont.) 



This chart shows the categories of information that can be saved in 
EEPROM and the corresponding page numbers to find more information. 



0 


- SET menu 


5-3 


1 


- Contents of Emulator registers 


5-70 


2 


- Event Monitor System 


7-1 




WHEN/THEN statements 




3 


- Overlay map 


5-54 


4 


- Software switch settings 


5-9 


5 


- Macros 


5-102 



Variables are loaded from EEPROM back to the Emulator using the LD 
command. 

When you first use the Emulator, you should execute a SAV command with 
no parameter. This initializes EEPROM, so that subsequent LD commands 
will work properly with the 8086 Emulator board and pod. 



Examples 



>SAV 1 



Saves the current values of all the Emulator registers in EEPROM. 
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LOAD SYSTEM VARIABLES FROM EEPROM 



Command 



Result 



LD 



Copies all system variables 
stored in EEPROM into 
Emulator memory. 



LD <category> 



Copies the variables from one of 
the six categories in the 
EEPROM to the Emulator 
RAM. 



Comments 



This command is valid only in pause mode. 

Executing a LD command reads system variables from the EEPROM and 
copies them to into internal RAM. The EEPROM retains those original 
variables until replaced by a SAV command. 

There is room in the EEPROM to load the system variables for two 
different users. The user is determined by a parameter in the SET menu. 

You may load the following variable categories from EEPROM: 



0 - SET menu 

1 - Contents of Emulator registers 

2 - Event Monitor System WHEN/THEN statements 

3 - Overlay map 

4 - Software switch settings 

5 - Macros 



( continued ) 
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LOAD SYSTEM VARIABLES FROM EEPROM (cont.) 



Examples 



The overlay memory map in the EEPROM is copied into internal RAM. 
Use the DM command to verify the new map. (See page 5-55.) 
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Section 5: System Commands 



Serial Communications 

The ESI 800 can communicate through both DB-25 connectors on the 
chassis rear panel using standard RS232C serial protocol. The ports can be 
independently configured for baud rate, data length, and number of stop 
bits. 

USING A HOST COMPUTER 

The most common development configuration is with a terminal connected 
to the terminal port of the ES1800 and a host development system 
connected to the computer port. The ESI 800 provides a transparent mode 
that essentially connects your terminal to the computer. The ESI 800 also 
has a special download command to load modules from the host system. 

In configurations where the ESI 800 is connected directly to a host 
computer, there are a few details that need to be considered. 

DATA BUFFERING AND BAUD RATE 

When downloading from a computer, the ESI 800 buffers all the data bytes 
until the end of record. If the checksum is correct, the data are then 
loaded into target memory. During this load time, the host computer may 
start sending the next data record. The serial data buffer in the ESI 800 is 
64 bytes deep. When the sixth character is placed in the buffer, an XOFF 
character is sent to the host computer. This means that the host computer 
must transmit no more than 58 characters after the XOFF. Some multi- 
tasking development systems may not be capable of quickly stopping 
character transmission. For these systems, it may be advisable to lower the 
computer port's and host computer's baud rates. 

XON and XOFF characters can be used to control either output port on the 
ESI 800. These characters are user definable. The problem described in 
the above paragraph can happen in the reverse direction. If the ESI 800 is 
uploading data to the host, it may be able to overrun the host's ability to 
receive characters. While lowering baud rates may help, there are probably 
commands available on the host to solve the problem. You should also 
make sure that the host does not echo characters sent to it while uploading 
data. If the characters are echoed, the ESI 800 will quickly send an XOFF 
to the host while continuing to send normal upload characters. The host 
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system will then probably send an XOFF to the ESI 800 because the host's 
buffers are full. The result of this situation is that both systems will lock 
up waiting for the other to send an XON. See your system administrator or 
call Applied Microsystems Corporation customer service at 
1-800-426-3925 for help. 

COMMUNICATION WITH THE HOST COMPUTER 

While in transparent mode, the ESI 800 passes characters between the 
computer and terminal ports. There is a user definable two-character 
escape sequence to exit transparent mode. If the first character of the 
escape sequence arrives at either port, the ESI 800 holds it until it receives 
another character from the same port. If the second character matches the 
second character of the escape sequence, transparent mode is terminated. 
If the second character is not part of the escape sequence, then both the 
character being held and this second character are sent to the proper port. 
See page 1-4 for setting the escape character sequence. 

While in transparent mode, the only characters that are meaningful to the 
ESI 800 are XON, XOFF, the first character of the escape sequence, and 
the reset character. The reset character may be sent from the host as part 
of a command sequence to the terminal. This is common during edit 
sessions and depends on the command set of your terminal. You should 
define the reset character to be a character that will not normally be used 
by the host system. 

PORT DEPENDENT COMMANDS 

Most commands are symmetric with respect to the controlling port and 
appear to respond in the same manner if entered from either the computer 
port or the terminal port. The "controlling" port is determined at power- 
up by the setting of the thumbwheel switch on the controller board (see 
3-5). After power-up, the commands CCT and TCT switch control from 
one port to the other. TCT entered to the terminal port acts like a null 
command as does a CCT entered at the computer port. 
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Entering transparent mode from either port causes both ports to be 
"connected" to each other. If transparent mode is terminated from either 
port, control returns to the port that initiated the transparent mode (TRA) 
command. 



DOWNLOAD FROM TERMINAL PORT 

When the ESI 800 receives a download command (DNL), it always expects 
data records to arrive at the computer port. If the download command is 
entered from the terminal port, the ESI 800 automatically enters 
transparent mode to allow you to send commands to the host system. You 
normally enter a command that causes the host system to copy the 
formatted object file to your terminal (see page 5-7 for setting serial data 
format). The proper procedure is to enter the command to the host system 
but not terminate it (i.e., do not press the 1 return] key). Instead, enter the 



two-character transparent mode escape sequence. When transparent mode 
terminates, control returns to the download process. The download routine 
then sends the user definable command terminator sequence to the host 
system (see page 5-3 for setting the command terminator sequence). The 
host system responds by sending the data records from the formatted 
object file. Any characters sent by the computer are echoed to the 
terminal port. All valid data records are copied into internal buffers and 
the data written into target memory. When the End of File (EOF) record is 
received, the download process terminates and a normal ESL prompt is 
displayed. 

If an error occurs (checksum or read-after-write) during the download, 
the process terminates with an error and a new prompt is displayed. No 
special characters are sent to the host, however, so it is likely that the next 
time you enter transparent mode, the host will send the remainder of the 
download data records. 



DOWNLOAD FROM COMPUTER PORT 

If the download command is entered from the computer port, the process is 
different. In this case, the ESI 800 does not enter transparent mode. The 
DNL command can be immediately followed by data records. Each data 
record is acknowledged with an ACK (6) character if its checksum is 
correct and correctly written into target memory (verified with read- 
after-write cycles). The EOF record is also acknowledged if valid. If an 
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error occurs during a download, the first character sent back to the host 
will be the BEL (7) code. Programs written on the host system can use 
these two characters to handshake the data records in an automatic 
download routine. 
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TRANSPARENT MODE 



Command 



Result 



TRA 



The system enters transparent 
mode. 



ESC ESC 



Port control is returned to the 
previous settings. Note that this 
escape sequence can be changed 
using the SET command (page 
5-3). 



Comments 



Transparent mode can be entered while in terminal (TCT) or computer 
control (CCT) modes. 

In transparent mode the Emulator acts only as an interface between the 
two serial ports. The Emulator can buffer up to 64 characters for each port 
and can operate each port at independent baud rates. 

There must be devices connected both to the terminal port (such as a 
terminal) and the computer port (host system, line printer) for this 
command to have any meaning. 

Transparent mode is used to communicate with a host computer or any 
other peripheral you want to attach to a serial port. 

Refer also to Serial Communications (page 5-29). 
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TRANSPARENT MODE (com ) 



Examples 



>TRA 
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TERMINAL PORT CONTROL 



Command Result 



TCT The terminal port becomes the 

controlling port. 



Comments 



This command, along with the CCT command, allows control to be 
switched between to two serial ports without powering down the ESI 800 
Emulator. 

Any output generated by a command is directed to the controlling port. 
The copy switch directs output to both serial ports. 

This command is essentially a null command when entered from the 
terminal port. 

Port selection on power-up is controlled by the thumbwheel switch setting. 
(See page 3-5.) 
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COMPUTER PORT CONTROL 
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CCT The computer port becomes the 

controlling port. 



Comments 



This command, along with the TCT command, allows control to be 
switched between the two serial ports without powering down the ESI 800 
Emulator. 

Any output generated by a command is directed to the controlling port. 
The copy switch directs output to both serial ports. 

This command is essentially a null command when entered from the 
computer port. 

If there is a host attached to the computer port and you type a CCT from a 
terminal connected to the terminal port, the host system takes control of 
the Emulator. The host system must be able to handle incoming data at 
high rates. Both hardware and software handshakes are supported (see 
page 3-12). 

The upload and download operations always send/receive data from the 
computer port regardless of which port is the designated controller. 

If you execute CCT in error with no terminal or host system connected to 
the computer port: 

■ Move the terminal cable to the computer port, enter the 
TCT command and return the cable to the terminal port. 

This process will work in most cases to return control to 
terminal. If not: 
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■ Turn the Emulator off and then on. 

This command can be executed from the computer port (see page 5-30 for 
a discussion of port dependent commands). For port selection on power- 
up refer to page 3-5. 
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DOWNLOAD OPERATIONS 



Command Result 



DNL DNL readies the Emulator to 

receive data. If in terminal 
control mode, the Emulator 
enters a transparent mode 
automatically, allowing direct 
communication with the host 
system. Other host system 
commands may be executed 
prior to the download operation. 



Comments 



You can choose the destination of the downloaded file: 

■ Target memory 

■ Emulator overlay memory 

If the downloaded data is going to overlay memory, verify that the overlay 
is mapped in the appropriate address range. Make sure that the start 
address of the file is the address to which you expect to download. 

Verify also that the data format of the host system file matches that being 
used by the Emulator. Refer to SET menu set parameter #26 for 
verification of Emulator format (see page 5-7. Use transparent mode 
(TRA) to verify host system format and the address in the file. (See page 
5-33.) 

You can download files with either the computer port or the terminal port 
in control. That is, the downloading of files can be initiated and controlled 
either by the user or by a host system. There are some differences in 
procedure depending on which port is in control of the downloading 
process. 
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DOWNLOAD OPERATIONS (cont.) 



DOWNLOADING UNDER TERMINAL PORT CONTROL 

After typing DNL, the system automatically enters transparent mode, 
allowing communication with the host system. When you are ready to 
download the file, enter a command that causes the host system to display a 
file to the terminal, but in place of a [return] , enter the transparent mode 
escape sequence (see page 5-33). 

The Emulator is now ready to read the data records the host system will be 
sending. Data records are displayed as they are received by the Emulator. 
Checksums are verified and if a checksum error occurs, the download is 
aborted with an error message. The data in the erroneous record will not 
have been written to memory. 

Each data byte is verified with a "read after write" cycle. If an error is 
detected, the download is aborted. 



RETURN CONTROL TO EMULATOR 

Once the download command (DNL) is entered, control is returned to the 
Emulator in one of three ways: 

1 . An end of file record is received. If an end of file record 
is not recognized by the Emulator, control will not be 
returned to the Emulator terminal port. This can be 
caused by: 

■ Using a [return | instead of the proper 
escape sequence to terminate the 
command line to the host computer 

■ Selecting the incorrect data format. 

2. An Emulator reset is executed (default is CTRL Z). 

3. An error is detected. 
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DOWNLOAD OPERATIONS (cont.) 



DOWNLOADING UNDER COMPUTER PORT CONTROL 

To download while in computer control with a host computer attached, the 
host computer should send: 



>DNL 



After the host sends the download command, the Emulator waits for data 
at the computer port. The host computer should then send the 
downloadable records followed by an end of file record. After the end of 
file record, the system prompt ( 0 ) is sent to the computer port. 

An acknowledge character (factory default is ASCII ACK $06) will be sent 
to the computer port after storing a data record, when in computer control. 
No acknowledgments are sent when in terminal control. 

There are some differences between computer port control and terminal 
port control during the downloading process. Under computer port 
control: 



All good records are adknowledged with an |ack $6 



All error messages from bad records are received on the 
computer port; therefore the host file that is controlling the 
Emulator will need to be able to interpret error messages. 

Records are not echoed. 



SYMBOLIC DOWNLOAD 

The download command accepts symbolic definition records as well as 
data records when the symbolic debug option is used and the Emulator 
download format variable is set to 5 (Extended Tekhex). (See SET 
parameter #26, page 5-7.) 

Serial data can be verified with memory constants using the VFY 
command. 
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DOWNLOAD OPERATIONS ( cont.) 



Errors 



CHECKSUM ERROR IN THE DATA RECORD 

The download process is aborted because the checksum sent with a record 
file is not the same as the checksum calculated by the Emulator. 

READ AFTER WRITE VERIFY ERROR 

Every byte in a data record is verified after it is stored. This error 
indicates that the data in memory does not match the data that was stored. 

Problem What to Check 



Emulator does not return a prompt 

after file has been sent. 1 ■ Serial data format " SET 

menu. 

2. No end of file (EOF) 
record. 

3. You entered a Ireturn 
instead of the 
transparent mode escape 
sequence after entering 
the host copy command 



Read-after-write verify error. 

1. Target hardware 
problem. 

2. Overlay memory not 
mapped in download 
range. Address is 
indicated by misverify 
message. 
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DOWNLOAD OPERATIONS (cont.) 



Checksum error. 



1. Improperly formatted 
record sent by host. 

2. Noisy serial data lines. 

3. Host computer is not 

rocnnnHino tn 

XON/XOFF protocol. 



Display of data does not 
commence after entering 
transparent mode escape 
sequence. 



Host not responding to 
user defined command 
terminator sequence - 
SET menu (page 5-3). 



If the Emulator does not return a prompt, you will need to reset the system 
(default is CTRL Z) in order to enter any other Emulator commands. 

If the host computer does not respond to the XON/XOFF protocol fast 
enough, you may need to lower the baud rate on the computer port and the 
host computer. 
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VERIFY SERIAL DATA 



Command Result 



VFY Verifies serial data with data in 

memory. If the data in memory 
does not match the incoming 
serial data, this message is 
displayed: 



ADDRESS = XX NOT YY 

Address is the address where the 
data mismatch occurred. XX 
denotes the actual data present 
at that location. YY is the serial 
data just sent. 



Comments 



This command is similar to the download command but no data is written 
to memory, and the serial data is not displayed on the screen. The serial 
data is compared to the data in target or overlay memory. Mismatches are 
displayed. 

Use this command if you suspect a file you downloaded was corrupted. If 
downloaded data is being corrupted by your program, you can detect it by 
mapping overlay as RO (read only) (see page 5-57.) 

This command is also useful for determining differences between object 
files. Follow instructions for downloading a file on page 5-38. 
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UPL <range> The Emulator formats and sends 

data to the computer port. 



Comments 



Data is transferred from the Emulator to a host system or other peripheral 
interfaced to the Emulator computer port. 

When uploading to a file on a host system, enter transparent mode first and 
open a file to store the uploaded data records. (Review the Serial 
Communications discussion, page 5-29.) 



Examples 



For UNIX: 



Cat ><filename> 



For VMS: 



TYPE ><filename> 



(Create or EDT are also acceptable.) 
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UPLOAD SERIAL DATA (cont.) 



For CPM: 



PIP A:<filename> = RDR: 



Next, type the transparent mode escape sequence and the upload 
command. 

After all data has been uploaded and the Emulator prompt returns, enter 
transparent mode and close the file by entering the appropriate control 
character. 

Remember to close the file before trying to view it. 

If the host system does not respond to XON/XOFF protocol, it may be 
necessary to lower the communicating port's baud rates so that the host's 
input buffer is not overrun. 

Upload performs no data verification. 

A file may be uploaded to a printer, PROM programmer, or other 
peripheral instead of to a host. In this case, there is no need to enter 
transparent mode before uploading. Just be sure the peripheral is ready to 
receive data. 

Refer also to Serial Communications, page 5-29. 
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UPLOAD SYMBOLS 



UPS All currently defined symbols 

and sections are sent to the 
computer port in Extended 
Tekhex format. 



Comments 



Extended Tekhex restricts the number and range of characters that can be 
used for symbol names. When formatting symbols for upload, the 
Emulator truncates symbol names to 16 characters and substitutes for 
characters not allowed by Tekhex. 

Extended Tekhex serial data format should be set before uploading 
symbols (see SET parameter #26, page 5-7). 

When uploading to a file on a host system, enter transparent mode first and 
open a file to store the uploaded data records. (Review the Serial 
Communications discussion page 5-29.) 



Examples 



For UNIX: 



Cat ><filename> 
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For VMS: 

TYPE ><filename> 

(Create or EDT are also acceptable.) 
For CPM: 

PIP A:<f i Lename> = RDR: 

Next, type the transparent escape sequence and begin uploading. 

After all data has been uploaded and the Emulator prompt returns, enter 
transparent mode and close the file by entering the appropriate control 
character. 

Remember to close the file before trying to view it. 

Refer also to Serial Communications, page 5-29 and Symbols, page 5-111. 



5-47 



COMMUNICATION WITH TARGET PROGRAMS 



Command Result 



COM <address> Establishes communication with 

the target program through a 
two-byte psuedo-port at the 
specified address. 

Exit COM mode by entering the 
two-character transparent mode 
escape sequence (see SET, page 
5-3). 



Comments 



Only useful during run mode. 
Affects real time operation. 

Requires special target code. COM mode uses two bytes at the specified 
address. The byte at <address> is used for characters sent from the target 
to the controlling port. The byte at <address> + 1 is used for characters 
being sent to the target program. This command makes use of 7-bit ASCII 
characters, with the eighth bit of each byte used for handshaking. 

To transmit a character to the ESI 800, the target program first checks the 
most significant bit (MSB) of the byte at <address>. If this bit is set (1), 
the Emulator has not yet collected the previous character. If the bit is 
cleared, the target program sets the MSB of the character to be transmitted 
and places the result in the byte at <address>. 

To receive a character from the Emulator, the target examines the byte at 
<address> + 1. If the MSB of this byte is cleared, the Emulator has not yet 
transmitted a new character. If the MSB is set, the character is "new." If 
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the controlling port of the ESI 800 is a terminal, the target program should 
echo the character by immediately copying it into the byte at <address> 
with the MSB still set. The target then program masks the MSB off and 
stores the result back at <address> + 1 . This prevents the target program 
from re-reading the same character. 

The COM routine does not check the byte at <address> + 1 to see if the 
target program has received it. Generally, the target program will be 
substantially faster than the COM routine and will always receive one 
character before the COM routine can transmit the next. 

In effect, the COM mode establishes a "transparent mode" between the 
running target program and the controlling port of the ESI 800. Whenever 
the ESI 800 reads target memory during run mode, it actually stops 
emulation for about 100 microseconds. To avoid significant impact on real 
time operation, the COM routine examines the byte at <address> only 
once every 0.5 seconds. When the COM routine discovers a new byte from 
the target program, it reads the byte and clears the location. The byte is 
then sent to the controlling port of the ESI 800. The COM routine then 
immediately returns to examine the byte at <address>. A target output 
routine has approximately 100 microseconds to place another character in 
the output location. If this 100 microsecond window is missed, the display 
of the subsequent character is delayed for 0.5 second. 

The flow diagram on the next page summarizes the COM process. 



( continued ) 
5-49 



COMMUNICATION WITH TARGET PROGRAMS (cont.) 



Figure 6. Flow Chart 
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Examples 



One good use of the COM command is to simulate a serial I/O port when 
debugging code before target hardware is available. The RUN command 
downloads the target program into overlay memory and enters run mode. 
The address supplied to the COM command is that of a simulated RS232 
data port. Data entered at the terminal is passed to the target program, and 
data output by the program appears on the screen. 



>MAP 0 TO -1 /* 


Map all available overlay memory*/ 


>DNL 




%cat sen' a I. driver /* 


Download program to overlay */ 


(enter transparent mode escape sequence) 




>RNV /* 


Run program */ 


R>COM 'serial_port /* 


Use serial data port as COM addr */ 



A note of caution: if a breakpoint or an error is encountered while running 
the COM command, the system will appear to hang up. This is because 
emulation has been broken, and the target program that receives and 
transmits characters is no longer running. Entering the transparent mode 
escape sequence will terminate COM mode and cause the break or error 
message to be displayed. 
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nmmtt 



r.d Result 



DIA <address> Reads and displays characters 

from target memory starting at 
the specified address. The DIA 
routine terminates when it reads 
fool from target memory. 

Affects real time operation 
when entered in run mode. See 
page 6- 1 . 



Comments 



DIA is commonly used for test purposes in target systems that have no 
human-readable I/O channels. 

When a test routine detects a problem, it can load a register with the 
address of a null terminated error message. The routine then jumps to an 
address that causes the Emulator to break emulation. The DIA command 
can then be used to display the error message. 

DIA can also be used to check the contents of any null terminated string in 
memory. 
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Examples 



>BYM 




Make sure we're in byte mode. 


>M 120 




Enter Memory mode at address 120 


$000120 $00 


>48,65,6C,6C,6F,0 




$000126 $00 


>X 


Enter a null terminated string and exit 


>DIA 120 




Display string starting at 120 


Hello 
> 







This example sets a breakpoint in the target error routine. When the 
breakpoint occurs, a message pointed to by the ES:BX register pair is 
displayed. If the DX register is zero, the process stops. Otherwise, the 
ESI 800 immediately begins emulation and waits for another breakpoint 
and message. 



>AC1 = 'Error_stop 

>WHE AC1 THE BRK 

>* RBK;WAI ;DIA ES:BX;TST = DX 
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Overlay Memory 

Overlay memory can be used to debug target hardware and software. It 
can be used to create and verify programs before hardware is available, 
determine whether the program is making illegal accesses, and patch target 
PROM code quickly and easily. 

Overlay memory is available in memory ranges from 32K to 512K. See 
your Applied Microsystems Corporation sales representative for 
incremental options. 

Overlay can be mapped in segments as small as 2K bytes. Each segment 
can be assigned one of four attributes; target, read/write, read only, or 
illegal. If memory is mapped, it means that you have assigned at least one 
segment of overlay as read/write, read only, or illegal memory. 
Unmapped memory is assigned the target attribute. Memory mapped as 
target or illegal does not use up overlay memory. 

When a segment of memory is mapped, program accesses in that memory 
range are directed to the overlay instead of the target. The overlay can be 
further qualified by the overlay enable register (OVE). This register 
indicates whether code, data, or all accesses in a mapped memory range 
should be directed to the overlay memory. 

Overlay memory accesses occur in real time. No wait states are added by 
the Emulator. 
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Command Result 



DM Displays the memory map 

currently in effect. 



Comments 



This command is valid only in pause mode. 



Examples 



>DM 

MEMORY MAP: 

$000000 TO $FFFFFF:TGT 



Default map at power- up. 
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Command Result 



MAP <range> 



MAP <value> 



MAP <range><attribute> 



MAP <value><attribute> 



Maps the specified range and 
assigns it the default attribute 
type, RW. 

Maps a 2K-byte block 
surrounding the specified value. 
Assigns the block the default 
attribute type, RW. 

Maps the specified range and 
assigns it the specified attribute 
type. 

Maps a 2K-byte block 
surrounding the specified value. 
Assigns the block the specified 
attribute. 



Attributes 



RW Memory mapped as read-write (RW) responds like 

normal overlay memory. The overlay memory is high 
speed and may actually run faster than target system 
memory if that memory normally asserts wait states. 

RW is the most common attribute and is therefore the 
default. MAP commands that do not specify an 
attribute default to RW partitions. 
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RO 



ILG 



TGT 



Comments 



Overlay memory is mapped in segments of 2K bytes. When you specify an 
address or a range to be mapped as RW or RO, the mapping outline 
allocates the minimum number of 2K segments that will completely 
enclose the address(es) of interest (see Overlay Memory Enable, page 5-61. 

There is a distinction between the overlay map and overlay memory. If 
your system has any overlay memory installed (it is an option), you have a 
complete overlay map and some limited amount of overlay memory. The 
overlay map covers the entire address space (24 bits). The overlay map is 
used to logically place segments of overlay memory anywhere throughout 
the address space. 

You can save and restore the contents of the overlay map by using the 
EEPROM LD/SAV commands (see pages 5-27 and 5-25). You cannot save 
the contents of overlay memory in EEPROM. 
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Memory mapped as RO acts like read-only memory to 
the target program. If the program attempts to write to 
this memory, the ESI 800 aborts run mode and displays 
the error message, MEMORY WRITE VIOLATION RO 
overlay cannot be altered by a running target program. 

The same comments about speed given in the paragraph 
on RW apply to memory mapped as RO. You can always 
modify memory mapped as RO (in pause mode) even 
though the target program (run mode) cannot. 

Memory mapped as illegal can be used to mark address 
ranges that should not be accessed by the target 
program. Any access to an address range mapped as 
ILG causes the ESI 800 to abort run mode and display 
the error message, MEMORY ACCESS VIOLATION. 
Memory mapped as ILG does not use up available 
overlay memory. 

The ESI 800 ignores accesses in address ranges mapped 
with this attribute. Memory that is not explicitly 
mapped is defaulted to TGT. 



SET MEMORY MAP (cont.) 



Examples 



The following command sequence might reflect a common mapping: 



Command 




Comments 


>CLM 




Clear map to all TGT 


>MAP 0 TO - 1 : 1 LG 




Default entire address space to Illegal 


>LDV 




Sets CS:IP to 0FFFF0 (reset vector) 


>MAP CS:IP:RO 




Map ROM for reset vectors 


>MAP 'RAM_start LEN 20000 


Map some overlay memory to work with 


>MAP 'I/0_start:TGT 




Have I/O already in target space 


>MAP 0 LEN 800 




A! I nratp PAM few i pi^^ppi lot" \i&(*tc\x*<z 


>DM 




Display what we've done 


MEMORY MAP: 






MAP $000000 TO S0007FF 


RW 


Interrupt Vectors 


MAP $000800 TO S00FFFF 


ILG 




MAP $010000 TO $02FFFF 


RW 


Working RAM 


MAP $030000 TO $03FFFF 


ILG 




MAP $040000 TO $0407FF 


TGT 


I/O space 


MAP $040800 TO $0FF7FF 


ILG 




MAP $0FF800 TO SOFFFFF 


RO 


Reset vectors 


MAP $100000 TO SFFFFFF 
> 


ILG 
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Since the contents of overlay memory are not affected by changing the 
overlay map, you can compare the operation of a program in target 
memory with one in overlay memory. 



Command 


Comments 


>CLM 


Clear any previous mapping: 


>MAP 1000 to 7FFF:R0 


Map ROM over existing target program 


>L0V 1000 to 7FFF 


Copy target program into overlay memory 


>ASM 2000 


Use line assembler to make a patch 


(Assembler commands) 




>RNV 


Run patched version 


>STP;MAP 1000 TO 7FFF:R0;RVN 


Stop, Remove map, Run normal version 


>STP;MAP 1000 to 7FFF :RO;RNV 


Stop, Restore map. Run patched version 



If you do not have target memory but you still want to compare two 
programs, you can use a trick of overlay memory allocation. This example 
assumes you have 128K or more of overlay memory. 



Command 


Comments 


>CLM;MAP 0FFFF0:RO 


Need Reset Vector mapped as ROM 


>GR0 = 1000 LEN 8000 


Will save some typing 


>MAP GR0 


Map 32K bytes for code space 


>DNL 


Download first program into overlay 


(Download commands and records) 




>MAP GR0:TGT 


Unmap code space (The data is still 




in overlay memory) 


>MAP GR0 + 10000 


Remap but at higher address range. 




The first program now "exists" again 




but in a higher address range. 


>MAP GR0 


Now map more overlay at the normal 




range 


>DNL 


Download second program. 


(Download commands and records) 






Now you have a copy of both programs. 


>MAP GR0:TGT;MAP GRO + 20000 


Relocates second program out of the way 


>MAP GRO + 1 0000 :TGT; MAP GRO 


Relocates first program back to normal 




address range. 
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CLEAR MEMORY MAP 



Command Kesuit 



CLM The entire address range is 

assigned the TGT attribute. 

Comments 

This command clears all addresses from the overlay map. 
This command is valid only in pause mode. 
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Command 



Result 



OVE = CD + DTA 



The overlay memory decodes 
both code and data space. 



OVE = CD 



Only code status space accesses 
are decoded by overlay memory. 



OVE = DTA 



Only data status space accesses 
(including ALT, DAT and STA 
space) are decoded by overlay 
memory. 



Comments 



Overlay memory responds to an access only if a mapped address and the 
current OVE status match the cycle being executed. For more information 
about the four status spaces, see segment description in the raw trace 
section (page 5-96), and the iAPX 86/88, 186/188 Users Manual. 

CD is code space. The processor encodes it as code status. 

DTA is data space. The processor encodes it as data, alternate data or stack 
status. 

Overlay memory cannot be divided between CD and DTA on the same 
map. It is either all one (CD), or the other (DTA), or all both (CD+DTA). 

To display the value of the current status being used for memory access, 
use the MMS command (page 5-82). 
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LOAD OVERLAY MEMORY 



Command Result 



LOV <range> Moves data from the target 

system memory to the Emulator 
overlay memory in the specified 
address range. 



Comments 



This command is valid only in pause mode. 

In order to load overlay memory from the target memory, you must have a 
target system interfaced with the ES1800 Emulator and have overlay 
memory installed and mapped. 

In order to load a target memory range into the overlay memory at a 
different address, use the LOV command, then do a block move (BMO) of 
the data. 

Use the VFO command (page 5-63) to verify the memory move. 
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Command 



Result 



VFO <range> 



Compare the specified range in 
the target memory to the same 
range in the overlay memory. 

If there are no differences 
between the data in the overlay 
and target, the Emulator 
prompts you for the next 
command. 

If there are any differences, the 
address of each difference 
displays: 



<ADDRESS> = XX NOT YY 



Comments 



XX denotes the data present in 
overlay memory. YY is the data 
at that location in the target 
system memory. 



This command is valid only in pause mode. 
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Registers 

This section includes information on using the registers and a complete list 
of all the registers in the Emulator. 

The registers can be logically divided into four groups: 

■ microprocessor registers 

■ general Emulator registers 

■ target Peripheral Control Block (PCB) registers, those used 
only in iRMX mode and those used in non-iRMX mode 

■ Event Monitor System registers 

Each Emulator or Event Monitor System register accepts one or two of 
three value types: 

■ integer values 

■ range values 

■ don't care values 

Registers that accept range and don't care types can also be assigned 
integer values. 

Each register has a separate display base. The display base is viewed and 
changed with the BAS command (see page 5-80). Display bases are often 
changed for registers such as the Event Monitor LSA comparators, which 
you might like to see in binary, and the CTL register, which you might 
want to see in decimal. 

The CPU registers and the Event Monitor registers can be displayed as a 
group by using the DR and DES n commands. 

See Event Monitor System (Section 7) for Event Monitor System Register 
descriptions. 

The complete register set can be loaded from or saved to EEPROM. 
Executing a SAV or LD copies all system variables. A SAV 1 or LD 1 
copies only the register group. 
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PERIPHERAL CONTROL BLOCK (PCB) REGISTERS 

Because of the dynamic nature of some PCB registers, they are handled 
slightly differently than regular CPU registers. The following sections 
describe the problems and their solutions. 

GENERAL PCB HANDLING 

When the Emulator exits run mode, all memory and I/O space is searched 
for the PCB. When the PCB is located, it is moved to locations 
$FF00-$FFFF in I/O space. All register values are then copied to a table 
in internal RAM and uploaded to the ES controller. These register values 
are the ones displayed in response to the PCB command. The values in 
this table are modified by commands such as: 



MCWO=$1234 



or 



IST=$5678 



RELOCATION OF THE PCB 

The PCB is completely relocatable anyplace in memory or I/O. It contains 
an interrupt controller, two timers, three counters, two DMA channels and 
chip select circuitry for decoding memory and I/O space. There are many 
details to understand and remember when dealing with the PCB. These 
details are pointed out in the following subsections. 

Since the PCB is relocatable, there are several things that need to be 
understood concerning the registers in the PCB. On the run-to-pause 
transition the firmware takes a copy of the CPU registers and the registers 
in the PCB and stores them first in a RAM table on the Emulator board and 
then passes a copy of the registers to ESL. The copy that is sent to ESL is 
what is shown to the user. When you make a change to any of the registers, 
that change is simply stored in the RAM table kept by ESL. If you then 
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ask to look at those registers you see the change made, but the change is 
only to the RAM table and not to the CPU. 

Prior to the transition from pause to run the registers are passed to the 
firmware from ESL. The registers are then loaded into the CPU, and 
control is turned over to the target. So if you want to load a register into 
the CPU, you first need to equate the register to the correct value and then 
put the ESI 800 into either run mode or single step. 

On the run-to-pause transition, the firmware locates the PCB and moves it 
back to the power-up location of 0FF20 in I/O space. This is done because 
some users actually move the PCB to some other location. The firmware 
moves the PCB to its default location so that it will not write over the top 
of the PCB while in pause mode. 

If you use the MIO command to write to the PCB and change the contents 
of the registers, two questions may arise: 

The first is if you try to write to their PCB at the location you moved it to 
and can't find it. The second question may occur if you write to the PCB 
by using the MIO command and then look at the PCB registers through the 
ESL command (PCB) and find that the register you changed in the PCB 
was not changed in the ESL RAM table. If after you make the change to 
the PCB via the MIO command you then execute the RUN command and 
then wonder why the CPU didn't use the value loaded into the PCB. 

The answer to the first question is simply that the PCB is moved to the 
default location, so you will not find the PCB in the spot you moved it to. 
The PCB is always moved back to the correct location on the pause-to- run 
transition. 

The answer to the second question is that the values in the ESL RAM table 
are only loaded there from the PCB on the run-to-pause transition. Also 
the values loaded back into the PCB on the pause-to-run transition are 
from the ESL RAM table and therefore write over the top of anything that 
the user puts into the PCB. To avoid this problem, use the ESL command 
format provided for changing the values of the registers (see page 5-79). 

The commands do not modify the current contents of the physical PCB 
until the next pause-to-run transition. 
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When the Emulator enters run mode, the PCB register values contained in 
the RAM table mentioned above are reloaded into the physical PCB. The 
PCB is then moved back to its location in the target address space and the 
Emulator enters the target system. 

EXCEPTIONS 

The Emulator may be configured to allow some or all of the integrated 
peripherals controlled by the PCB to continue operating during pause 
mode. 

TIMERS 

The ON/OFF switches TEO, TE1, and TE2 are used to selectively 
enable/disable the integrated timers during pause mode (see page 5-23). 

If the switch is set to ON, the timer registers are handled as described in 
the general procedure upon the run-to-pause transition. On the pause- to- 
run transition, none of the timers' values are reloaded to the physical PCB, 
as this would destroy the data generated during pause mode. 

If the switch is set to OFF (disable time during pause mode), the mode 
control (MCWO) for the particular timer is copied to the RAM table upon 
run to pause; the timer is then disabled by clearing bit 15 of the mode 
control word. Upon pause-to-run, the value in the RAM table is reloaded 
to the physical PCB. This restores the timer to its configuration when last 
running in the target system. 

DMA CONTROLLERS 

The ON/OFF DME switch selectively enables/disables DMA operation 
during pause mode. Note that all DMA cycles are disabled immediately 
upon run-to- pause transition by the asserting of an NMI to the CPU, 
which then sets bit 15 of the 1ST register (DHLT bit). 

If the switch is set to ON DME, the 1ST register is copied to the RAM 
table. The DHLT bit is then cleared, causing DMA cycles to resume. All 
DMA cycles are steered to the target system. 
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Upon pause-to-run transition, the RAM table value of the 1ST register is 
reloaded to the physical PCB. If you want DMA activity to continue when 
reentering run mode, be sure the CDH soft switch is turned on. 

No DMA register values are reloaded to the physical PCB with this setting. 

-i± mo avmui la sci iu wrx- ryivAXi, mc icgisieis arc iianuieu as 

described in General PCB Handling. 
CHIP SELECT REGISTERS 

The ON/OFF RCS switch controls the Emulator's reading of the LMCS, 
MMCS, MPCS, and PACS registers upon run-to-pause transition. 

If the switch is set to ON RCS, all chip select registers are read and 
restored as described in "General PCB Handling." 

If the switch is set to OFF RCS, these chip select registers are read and 
copied to the RAM table only if you have manually set the register value 
during pause mode (i.e., LMCS=1234). This is necessary because reading 
of these chip select registers enables them to drive the 80186/88's chip 
select lines. 

Upon pause-to-run transition, only the registers that have been modified 
during pause mode (i.e., LMCS=1234) are reloaded to the physical PCB. 
Note that when the switch is OFF, the displayed values of the chip select 
registers (LMCS, MMCS, MPCS, PACS) do not show what is actually in the 
PCB. 

When attempting to peek and poke into target space it is necessary to set up 
the CS registers first so the address is decoded and the correct CS line 
toggled. The CS registers can be set up either by running the code in the 
target system or by setting up each of the registers in ESL and then 
executing an STP to load them into the CPU. 

When making the transition from run to pause, whether it is during the run 
mode or during a step, the CPU picks up its NMI vector from the internal 
world, but it uses the target ready to complete the bus cycle. The NMI 
vectors are located at address 8, 9, A and B, which fall into the area of 
LMCS. So if the LMCS is not set up and a break occurs or a step, then the 
ES hangs up waiting for a ready from the target. 



5-68 



Section 5: System Commands 



When reading the contents of the CS registers the value returned is often 
different from the value written into the register. This is a function of the 
CS registers having some bits that are read only. LMCS register bits 3, 4 
and 5 are always high. MMCS register bits 3 through 8 are always high. 
PACS register bits 3 through 5 are always high. UMCS register bits 3 
through 5, 14 and 15 are always high. 

INTERRUPT CONTROLLER REGISTERS 

Upon pause-to-run, the poll status register (POS) and its value are copied 
to their own table entry as well as the entry for the poll register (POL). 
This is necessary to prevent setting the IS bit of any pending interrupt. 
Both registers also show the same data in the PCB. 

Because these two registers are Read Only, they are not reloaded to the 
physical PCB upon pause-to-run transition. 

On the run-to-pause transition all interrupts are disabled because there is 
no way for the ES to handle interrupts during pause. This means that both 
external and internal interrupt sources are ignored and not processed. 
Interrupts are restored to their previous condition upon the pause-to-run 
transition. If any of the interrupts that occurred during pause are still 
pending upon the pause -to -run transition, they are serviced at that time. 
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Microprocessor Registers 



± ^ CLXxJlW 




iype 


L>engin ^diis ) 


AX, AL, AH 


accumulator (low and high) 


Int 


16,8,8 


BP 


base pointer 


Int 


16 


BX, BL, BH 


base (low and high) 


Int 


16,8,8 


CS 


code segment 


Int 


16 


CX, CL, CH 


count (low and high) 


Int 


16,8,8 


DI 


destination index 


Int 


16 


DS 


data segment 


Int 


16 


DX, DL, DH 


data (low and high) 


Int 


16,8,8 


ES 


extra segment 


Int 


16 


FLX, FLL, FLH 


flags (low and high) 


Int 


16,8,8 


IP 


instruction pointer 


Int 


16 


SI 


source index 


Int 


16 


SP 


stack pointer 


Int 


16 


ss 


stack segment 


Int 


16 



General Emulator Registers 



Name 


Description 


Type 


Length (bits) 


DFB 


default base 


Int 


8 


GD0-GD7 


general purpose data 


DC 


32 


GR0-GR7 


general purpose range 


Range 


32 


IDX 


repeat index register 


Int 


32 


IOP 


I/O mode pointer 


Int 


16 


LIM 


repeat limit register 


Int 


32 


MMP 


memory mode pointer 


Int 


32 


MMS 


memory mode status 


DC 


16 


OVE 


overlay enable 


DC 


8 


TST 


terminator for repeats 


Int 


32 
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Section 5: System Commands 



Target Peripheral Control Block (PCB) Registers 



Name Description 



REL relocation register 

UMCS upper memory chip select control 

LMCS lower memory chip select control 

MMCS mid-range memory chip select control (base address) 

MPCS mid-range memory chip select control (block size) 

PACS peripheral chip select control 

TCO timer #0 count register 

TCI timer #1 count register 

TC2 timer #2 count register 

MAO timer #0 max count A register 

MAI timer #1 max count A register 

MA2 timer #2 max count A register 

MBO timer #0 max count B register 

MB1 timer #1 max count B register 

MCWO timer #0 mode control word register 

MCW1 timer #1 mode control word register 

MCW2 timer #2 mode control word register 

USRCO dma #0 upper 4 bits of source address 

USRC1 dma #1 upper 4 bits of source address 

SCR0 dma #0 lower 16 bits of source address 

SCR1 dma #1 lower 16 bits of source address 

UDST0 dma #0 upper 4 bits of destination address 

UDST1 dma #1 upper 4 bits of destination address 

DST0 dma #0 lower 16 bits of destination address 

DST1 dma #1 lower 16 bits of destination address 

XC0 dma #0 transfer count 

XC1 dma #1 transfer count 
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Target Peripheral Control Block (PCB) Registers ( cont.) 



Name Description 

CWO dma #0 control word 

CW1 dma * 1 control word 



PCB Registers Used Only in iRMX Mode 



Name Description 

EOI specific end of interrupt register 

MSK mask register 

PLM priority level mask register 

ISV in service register 

IRQ interrupt request register 

1ST interrupt status register 

IV interrupt vector register 

DMAO level #2 interrupt control register (dma #0) 

DMA1 level #3 interrupt control register (dma # 1 ) 

TMRO level #0 interrupt control register (timer #0) 

TMR1 level #4 interrupt control register (timer #0) 

TMR2 level #5 interrupt control register (timer #0) 



5-72 



Section 5: System Commands 



PCB Registers Used in Non-iRMX Mode 



JName 




1 "\ s\ c% /~\ -»- * ■^"•1 f\ ~n 

uescripiion 


POT 




pun ICglblCl 


POS 




poli status register 


MSK 




mask register 


T>T AM 

x IjIVI 




priuiiiy icvci iiidaiv icgisici 


ISV 




in service register 


IRQ 




interrupt request register 


1ST 




interrupt status register 


IV 




interrupt vector register 


TCR 




timer interrupt control register 


DMAO 




dma #0 interrupt control register 


DMA1 




dma #1 interrupt control register 


TXTTA 

INTO 




interrupt control register #0 


INT1 




interrupt control register # 1 


INT2 




interrupt control register #2 


INT3 




interrupt control register #3 






Event Monitor System Registers 


Name 




uescnpuon Aype i_<engin ^uiib^ 


AC1.1 


-AC1.4 


address comparator Range 24 


AC2.1 


-AC2.4 


address comparator Range 24 


CTL.l 


-CTL.4 


count limit comparator Int 16 


DC1.1 


-DC1.4 


data comparator DC 16 


DC2.1 


-DC2.4 


data comparator DC 1 6 


LSA.l 


-LSA.4 


logic state comparator DC 16 


S1.1-S1.4 


status comparator DC 16 


S2.1-S2.4 


status comparator DC 1 6 


SIA 




special interrupt address Int 32 
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DISPLAY/LOAD MICROPROCESSOR REGISTERS 



Command Result 



DR Displays values of all 

microprocessor registers. 



>DR 

CS:IP FLX AX BX CX DX DS SI ES DI BP SS SP 

0000:0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 



<registername> Displays the value of the 

specified microprocessor 
register in its display base. 

<register name>=<exp> Assigns the specified register 

the value <exp>. 

CLR Clears the four CPU data 

registers; AX, BX CX, and DX. 

LDV Loads the reset vectors into the 

CS, IP and FLX registers. The 
reset vectors can also be loaded 
by the RNV and RBV 
commands. These load the 
vectors and enter run mode 
(page 6-5). 
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DISPLAY/LOAD MICROPROCESSOR REGISTERS (cont.) 



Comments 



On power-up an LDV command is automatically executed. This command 
sets the registers to Intel-defined default values. Register values may be 
saved to and loaded from EEPROM. 

The CPU registers are automatically copied from Emulator overlay 
memory to the microprocessor when run mode is entered. When emulation 
is broken, they are copied from the processor to Emulator overlay memory. 

If a CPU register is loaded with a value during run mode, a warning 
message is be displayed. This warning informs you that the value you are 
entering will not be sent to the pod CPU during emulation. The value is 
stored in the Emulator's internal memory, but when emulation is broken, 
the new value of the CPU register overwrites the value just entered. 

The display of the FLX register is different from that of the other CPU 
registers. The flags are more conveniently decoded by using an alpha 
character to indicate whether the flag was set or cleared by a particular 
instruction cycle. If the flag is clear, you see a [7| as a place holder. If set, 
the following characters describe the flag. 



N - 


Nested task 


0 - 


Overflow 


D - 


Direction 


I - 


Interrupt 


T - 


Trap 


s - 


Sign 


Z - 


Zero 


A - 


Auxi I lary carry 


P - 


Parity 


C - 


Carry 



If FLX were assigned the value $FFFF, the DR command would display 
the FLX register as: 



>DR 




















CS:IP 


FLX 


AX 


BX 


cx 


DX 


DS 


SI ES 


DI BP 


SS SP 


0000:0000 


NODITSZAPC 


0000 


0000 


0000 


0000 


0000 


0000 0000 


0000 0000 


0000 0000 
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DISPLAY/LOAD MICROPROCESSOR REGISTERS (cont.) 



Examples 

Load the data segment and verify that it contains the correct value. 



>DS=$A700;DS 

$A700 
> 
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DISPLAY PCB REGISTERS 



Command Result 



PCB Displays contents of the 

peripheral control block 
registers. 



Examples 



>PCB 












** RELOCATION REGISTER REL = 


20FF 








** CHIP SELECT CONTROL UMCS 


LMCS 


MMCS 


MPCS 


PACS 




FFFB 


0000 


0000 


0000 


0000 


** TIMER REGISTERS 
















TC 


MA 


MB 


MCW 




TIMER 0 


0000 


0000 


0000 


0000 




TIMER 1 


0000 


0000 


0000 


0000 




TIMER 2 


0000 


0000 




0000 


**DMA REGISTERS 














USRC SRC 


UDST 


DST 


XC 


CW 


CHANNEL 0 


0000 0000 


0000 


0000 


0000 


0000 


CHANNEL 1 


0000 0000 


0000 


0000 


0000 


0000 


**INTERRUPT CONTROL 


REGISTERS 










EOI POL POS 


MSK PLM 


ISV 


IRQ 


1ST 




0000 0000 0000 


0000 0000 


0000 


0000 


0000 




TCR DMA0 DMA1 


INTO INT1 


INT2 


INT3 






0000 0000 0000 


0000 0000 


0000 


0000 






> 
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LOADING REGISTERS 



Command Result 

<register> = <value> Sets <register> to <value>. 

<register> Displays register. 

Examples 

>UMCS = $FFFB 
>REL = $20FF 
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SET/DISPLAY REGISTER DEFAULT BASE 



Command Result 



BAS <register> Displays the decimal base of the 

specified register. 



#0 


- default 


#2 


- binary 


#8 


- octal 


#10 


- decimal 


#16 


- hexadecimal 



If the register has not been 
assigned a separate display base, 
the current default base is 
displayed. 



BAS <register>= <base value> Sets the display base of the 

register to the base value. 

If the base value for a register is 
set to 0, the current default base 
is used for display. 



Comments 



Base values may be stored in EEPROM and automatically loaded on 
power-up or manually retrieved using the LD or LD 1 command. 

Be careful when setting private display bases to unusual bases such as 4, 7 
or 1 1. The Emulator operates correctly, but the results may be confusing. 
If you set the base value to a value other than hexadecimal, decimal, octal, 
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SET/DISPLAY REGISTER DEFAULT BASE (cant.) 



or binary, the Emulator displays a question mark ( \jt\) preceding the base 
value when asked to display the base in effect. 

Refer to the default base command, DFB (page 5-86), to display the 
system global default base. 



Examples 



>BAS FLX 
>#16 



The value of GD3 is displayed in binary until you change its display base 
or power down the Emulator. 



>GD3 

S0000AA55 
>BAS GD3 = 2 
>BAS GD3 
#2 

>GD3 

%00000000000000001 010101 001 01 01 01 
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MEMORY MODE STATUS REGISTER 



Command 



Result 



MMS 



Displays the value of the 
current status being used for 
memory accesses. Refer to the 
iAPX 86/88, 186/188 Users 
Manual for details. 



MMS = <MMS register > 



Sets the status space for memory 
accesses. 



Comments 



The four registers that can be used for data accesses are: 



ALT - alternate 

DAT - data 

COD - code 

STA - stack 



Examples 



Memory commands use the alternate data register to access memory. 



>MMS = ALT 
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MEMORY MODE POINTER 



Command 



Result 



MMP 



Displays the current value of 
the memory mode pointer. 



MMP = <exp> 



Assigns the value <exp> to the 
memory mode pointer. 



Comments 



The MMP is the last address examined while in memory mode. If you 
enter memory mode without specifying an address, the MMP value is used 
as the entry point. 

The default power-up value of the MMP register is zero. This register 
may be saved to and loaded from EEPROM. 

The memory mode pointer is automatically modified when you scroll to a 
new address after entering memory mode. When you exit memory mode, 
the MMP reflects the last address examined. For more information on 
memory mode, see page 6-15. 



( continued ) 
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MEMORY MODE POINTER (cont.) 
Examples 

Sets an address comparator to the last address examined in memory mode. 

>M 6000 

(examine memory until you find a location of interest) 

$006013 5 A >X 
>AC1=MMP 



5-84 



I/O MODE POINTER 



Command 



Result 



IOP 



Displays the current value of 
the I/O mode pointer. 



IOP = <exp> 



Assigns the value <exp> to the 
I/O mode pointer. 



Comments 



The IOP is the last value examined while in I/O mode. If you enter I/O 
mode without specifying an address, the IOP value is used as the entry 
point. 

The default power-up value of the IOP register is zero. This register may 
be saved to and loaded from EEPROM. 

The I/O mode pointer is automatically modified when you scroll to a new 
address after entering I/O mode. When you exit I/O mode, the IOP 
reflects the last address examined. For more information on I/O mode, see 
page 6-36. 
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DEFAULT BASE 



Command Result 



DFB Displays the global default base. 

On power-up the default base is 
hexadecimal unless another 
default base was loaded by the 
EEPROM on power-up. 

DFB = #2 Sets the default base to binary. 

DFB = #8 Sets the default base to octal. 

DFB = #10 Sets the default base to decimal. 

DFB = #16 Sets the default base to 

hexadecimal. 



Comments 



Specific operators determine the base of the input value: 



Operator 


Description 


Example 


<%> 


Binary 


%10011 100001 111 


<\> 


Octal 


\23417 


<#> 


Decimal 


#9999 


<$> 


Hexadecimal 


$270 F 
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DEFAULT BASE (cont.) 



Base prefixes can be used any time to enter a value in a base different from 
the default base. Values not preceded by one of these prefixes are 
presumed by the Emulator to be in the default base. 

For example, if you set the global default base to binary, and you then 
want to assign a value to a register in a base other than binary, use a base 
prefix. 

The Emulator works correctly with any base between 2 and 16. However, 
if you set an uncommon base, such as 5 or 9, the results of assignments and 
commands may be confusing. 

If the base is outside the allowable range, an error message is displayed and 
the Emulator defaults to the hexadecimal base. 
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GENERAL PURPOSE DATA REGISTERS 



Command Result 



GD<0-7> Displays the value of the 

specified register. 

GB<0-7> = <\alue> Assigns a value to one of the 

eight general purpose data 
registers. 



Comments 



Use the general purpose registers as arguments to commands to save 
keystrokes when using values repeatedly. They can also be used to save 
space in macro definitions. 

These general purpose registers may be used in place of integer or don't 
care values in command statements. 

The general purpose data registers can be loaded with any integer or don't 
care value. They will not accept a range value. 



Examples 



General purpose data register 4 is loaded with 5000. GD4 can now be used 
anywhere you would use this integer value. 



>GD4 = 5000 
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GENERAL PURPOSE DATA REGISTERS ( cont.) 



If you are looking for a specific pattern on the LSA pod lines in more than 
one event group, assign a general purpose data register the value you are 
looking for. All subsequent LSA assignments can use this register. 



>GD2 = 


%01100101100 DC % 10011 




>LSA = 


GD2; LSA. 2 = GD2 




>GD3 = 


■datpatl DC %FF00 


Looking for one byte 


>DC1 = 


GD3 


of a specified word? 



If you have a hard time remembering the memory mode status mnemonics, 
use a general purpose register instead. 



>GD6 = ALT 




>MMS = GD6 




>GD1 = OVL+RD+IOA 


To set-up a breakpoint on an overlay 


>S1 = GD1 


read from I/O space. 
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GENERAL PURPOSE ADDRESS REGISTERS 



Command Result 



GR<0-7> Displays the value of the 

specified register. 

GR<0-7> = <value> Assigns a value to one of the 

eight general purpose address 
registers. 



Comments 



Use the general purpose registers as arguments to commands to save 
keystrokes when using values repeatedly. They can also be used to save 
space in macro definitions. 

These general purpose registers may be used in place of integer or range 
values in command statements. 

The general purpose data registers can be loaded with any integer or range 
value. 



Examples 



General purpose address register 4 is loaded with 5000. GR4 can now be 
used wherever you would use this integer value. 



>GR4 = 5000 
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GENERAL PURPOSE ADDRESS REGISTERS (cont.) 



Assign a register a range you will be using often. Then use it as a 
parameter for other commands. 



>GR0 = 'start_code LEN 20 
>DIS GRO 
>DB GRO 



If you do not know the absolute address in the target hardware, but have 
downloaded a symbol table containing them, then use the symbol names 
instead of looking up the hardware specifications. 



>GR2 = 'RAM LEN 'RAM_len 


Initialize GR2 


>SF 0 ( GR2 


Run a RAM test on your RAM 


>AC1 = GR2 


Set a breakpoint on any RAM access 


>WHE AC1 THE BRK 
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TEST REGISTER 



Command Result 



TST Stops repeating commands. The 

test register is set to an 
expression in a command line. 
When it becomes zero, the 
repeat halts. 



Comments 



See Repeat Operators (page 5-107) for more detailed information. 
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Section 5: System Commands 



Trace Memory 

During emulation, the activity of the executing program is recorded and 
stored in trace memory. All address lines, data lines, processor status lines, 
and 16 bits of external logic-state are traced. This record becomes a 
history of the program. If something unexpected happens during program 
execution, trace memory can be reviewed to determine what exactly took 
place. When used in conjunction with the trace disassembler, hardware 
and software problems may be found. 

Although you cannot access trace memory during emulation, you can stop 
program execution at any point- -either manually, or by using the Event 
Monitor System. The address, data, and control signals of the most 
recently traced cycles may be reviewed. 

Trace memory commands deal with the display and disassembly of trace 
memory data. Refer to the Event Monitor System (Section 7) for 
sophisticated uses of trace memory. 

Trace memory is 71 bits wide and 2046 bus cycles deep. Some bus cycles 
may be used for marks to identify start and stop points within the trace 
buffer. An unqualified trace contains all bus activity for the last 2046 bus 
cycles. 

NOTE: The sequence numbers in DT, DTB, and DTF (instructions) 
correlate with the line numbers displayed in the DRT (bus cycles). 
However, one or more bus cycles in the DRT display may make up one 
instruction on the DT, DTB or DTF displays. These displays may have 
missing sequence numbers indicating that a multiple bus cycle instruction 
has been executed. Also, the sequence number (SEQ #) may be repeated 
when two-byte wide instructions were executed from contiguous 
addresses. 
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DISPLAY RAW TRACE BUS CYCLES 



Command 



Result 



DRT 



Displays the last page of bus 
cycles recorded in trace 
memory. 



DRT <line number > 



Displays a page of the trace 
buffer starting with <line 
number >. 



DRT <range> 



Comments 



Displays the range of line 
numbers. XON and XOFF may 
be used to start and stop 
scrolling if the range is larger 
than the console display. 

Note that the range is a range of 
bus cycles, not the address 
recorded in the trace memory. 



SET parameter #13 sets the page length. Refer to SET (page 5-3). 
This command is valid only in pause mode. 
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DISPLAY RAW TRACE BUS CYCLES (cont.) 



Examples 



>DRT #50 



LINE 


ADDRESS 


DATA 


R/W 




M/IO 


BCYC 


SEQ 


QUE 


LSA - 8 


7 - 0 


#69 


001000 


> 


0FB9 


R 


OVL 


M 


IF 


c 


F 0 


%1 1 1 1 1 1 1 1 


%1 1111111 


#68 


001002 


> 


BE00 


R 


OVL 


M 


IF 


c 


2 


%1 1 1 1 1 1 1 1 


%1 1 1 1 1 1 1 1 


#67 


001004 


> 


2000 


R 


OVL 


M 


IF 


c 


2 


%1 1111111 


%1 11 111 11 


#66 


001006 


> 


00BF 


R 


OVL 


M 


IF 


c 


1 


%1 1111111 


%1 1111111 


#65 


001008 


> 


A522 


R 


OVL 


M 


IF 


c 


2 


%1 1111111 


%1 1111111 


#64 


001 00A 


> 


A4F3 


R 


OVL 


M 


IF 


c 


2 


%1 1111111 


%1 1111111 


#63 


001 OOC 


> 


8103 


R 


OVL 


M 


IF 


c 


3 


%1 1111111 

lO IIIIIIII 


%1 1111111 

fV IIIIIIII 




002000 


> 


FFSfl 
r rjU 


p 


UVL 


M 


PM 


V 




yi 1111111 

/o 1 I ! 1 1 1 1 1 


%1 1111111 

/o IIIIIIII 


#61 


002200 


< 


FF50 


w 


OVL 


M 


WM 


D 


4 


%1 1 1 1 1 1 1 1 


%11111111 


#60 


00100E 


> 


FF00 


R 


OVL 


M 


IF 


C 


3 


%11111111 


%1 1 1 1 1 1 1 1 


#59 


001010 


> 


02B9 


R 


OVL 


M 


IF 


c 


1 


%11111111 


%11111111 


#58 


002002 


> 


3E 


R 


OVL 


M 


RM 


D 


1 


%11111111 


%11111111 


#57 


002202 


< 


3E 


U 


OVL 


M 


WM 


D 


1 


%11111111 


%11111111 


#56 


002003 


> 


FF 


R 


OVL 


M 


RM 


D 


1 


%11111111 


%11111111 


#55 


002203 


< 


FF 


U 


OVL 


M 


WM 


D 


1 


%1 1 1 1 1 1 1 1 


%11111111 


#54 


002004 


> 


00 


R 


OVL 


M 


RM 


D 


1 


%11111111 


%11111111 


#53 


002204 


< 


00 


W 


OVL 


H 


WM 


D 


1 


%11111111 


%1 1 1 1 1 1 1 1 


#52 


002005 


> 


00 


R 


OVL 


M 


RM 


D 


1 


%11111111 


%11111111 


#51 


002205 


< 


00 


W 


OVL 


M 


WM 


D 


1 


%11111111 


%1 1 1 1 1 1 1 1 


#50 


002006 


> 


FF 


R 


OVL 


M 


RM 


D 


1 


%1 1 1 1 1 1 1 1 


%11111111 



LINE Line number 0 in the trace buffer indicates the last 

bus cycle prefetched or executed before the 
Emulator went into pause mode. The larger the line 
number, the further back in the history of the 
program you are viewing. You can get a good idea 
of the relationship of bus cycles to instructions by 
matching the bus cycle line numbers in the DRT to 
the SEQ# in the disassembled trace. 

ADDRESS 

DATA The address displayed is where the bus cycle took 

place, along with the data written to, or read from, 
that address. 
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DISPLAY RAW TRACK BUS CYCLES front. ) 



TAR/OVL 



M/IO 



BCYC 



\>\ and 0 are data direction indicators. They 
indicate whether data was read from an address 
( E ) or written to an address ( 0 ). These same 
indicators are used in the trace disassembly. 

TAR/OVL indicates whether the access was in the 
target memory area or in the Emulator's overlay 
(see DM command to determine what addresses are 
mapped). 

M/IO indicates whether the bus cycle access was a 
memory access (M) or an I/O access (10). This is 
determined by the program. 

BCYC indicates what type of bus cycle was run. 
This is determined by your program. The 
possibilities are: 



IAK 


interrupt acknowledge 


RIO 


read from I/O 


UIO 


write to I/O 


HLT 


halt 


IF 


instruction fetch 


RM 


read memory 


UM 


write memory 


NBC 


no bus cycles 


X87 


8087 microprocessor instruction 



SEG 



SEG indicates what type of segment is being used 
by the program for data accesses. The possibilities 
are: 



A - 


Alternate Data 


C - 


Code 


D - 


Data 


S - 


Stack 



Refer to iAPX 86/88, 186/188 Users Manual for 
definition of these segment types. 
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DISPLAY RAW TRACE BUS CYCLES (com.) 



QUE QUE indicates how many bytes (up to 6) are in the 

processor queue or how many were "flushed" 
(usually caused by a branch). A flush is indicated 
by a [q] preceding the queue depth value. 

LSA-8 7-0 LSA-8 7-0 columns display the state of each pin of 
the LSA pod during that bus cycle. 

NOTE: The same information that is recorded in 
the trace buffer can be used by the Event Monitor 
System to cause event actions. Therefore, 
everything in the trace buffer such as QUE flushes 
or WIO or any combination of these traced items 
can cause event actions such as selective tracing, 
counting, or breaking emulation (refer to the Event 
Monitor System, Section 7). 
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DISASSEMBLE TRACE MEMORY 



Command 



Result 



DT 



Disassembles and displays the 
last instruction in trace memory. 
A sequence number is not 
included. Overwrites current 
display line. 



DT <range> 



Disassembles a range of bus 
cycles, starting at the specified 
value and proceeding back in 
time. 



DT <value> 



Disassembles a page of trace 
starting at <value>. 



Comments 



This command is valid only in pause mode. 

A page is defined by the CRT length parameter in the SET menu. 

The sequence #0 is always the most recently recorded bus cycle in trace 
memory. If an argument is specified to the DT command, the values refer 
to the raw trace sequence numbers. 

The sequence number shown is a decimal value. For numbers larger than 
9, precede with a decimal ( [#[ ) base sign. 

When using the disassemble trace (DT) and the display register (DR) on the 
same line, make sure you enter DT before DR, because DT will overwrite 
the current line. It does this so that the STP;DT command used repeatedly 
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DISASSEMBLE TRACE MEMORY (cont.) 



will give a listing similar to a program listing without the STP;DT line 
between each command. 



Examples 



These two commands used in conjunction will produce output similar to a 
program listing. 



>STP;DT 



>DT 0 

SEQ# ADDR OPCODE MNEMONIC OPERAND FIELDS BUS CYCLE DATA 



0028 


000A 


8B4600 


MOV 


AX, WORD PTR [BP+0] 


0800>10C5 


0027 


000D 


050100 


ADD 


AX,1 




0024 


0010 


EBF4 


JMP 


SHORT 0006 




0020 


0006 


904600 


MOV 


WORD PTR [BP+0], AX 


0800<10C6 


0019 


0009 


90 


NOP 






0018 


000A 


8B4600 


MOV 


AX, WORD PTR [BP+0], AX 


0800<10C6 


0017 


000D 


050100 


ADD 


AX,1 




0014 


0010 


EBF4 


JMP 


SHORT 0006 




0010 


0006 


904600 


NOP 






0009 


0009 


90 


NOP 






0008 


000A 


8B4600 


MOV 


AX, WORD PTR [BP+0] 


0800>10C7 


0007 
> 


000D 


050100 


ADD 


AX,1 





SEQ# Correlates the disassembled instruction to 

the raw trace bus cycle. 

This is a decimal number and must be 
preceded by a [#] sign when referenced for 
selective disassembling of the trace. This 
corresponds to the line number in the DRT 
command display. 

ADDR The memory address or location where the 

instruction was fetched. 
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DISASSEMBLE TRACE MEMORY ( cant.) 



OPCODE 

MNEMONIC 

OPERAND FIELD 
BUS CYCLE DATA 



The machine-language (hex number) 
equivalent of the following assembly- 
language instruction. 

The command used to invoke the 
instruction. 

The assembly-language instruction. 

The bus cycle transaction, if any, that 
occurred as a result of the instruction. This 
includes any information written to, or read 
from, memory or I/O locations. 
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DISASSEMBLE TRACE PAGE 



Command Result 



DTB Disassembles the previous page 

of trace memory (from current 
trace memory pointer). 

DTF Disassembles the following page 

of trace memory (from the 
current trace memory pointer). 



Comments 



This command is valid only in pause mode. 

A page is defined by the CRT length parameter in the SET menu. Three 
lines are subtracted for header and prompt lines. 

Refer also to the DT command, page 5-98, the DRT command, page 5-94, 
and the slash command, page 5-110. 
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Macros 

A macro defines a list of commands or expressions that are executed with 
one command key word. This allows you to execute repetitive operations 
quickly and easily. 

You can define up to ten macros. They are referred to by the decimal 
numbers #0-9. The ten macros are linked in one buffer with #1 first, 
#2.. .#9, and #0 last. 

If the lengths of all ten macros exceeds the buffer length of 125 characters, 
the highest numbered macro is truncated. Spaces are also considered 
characters, so use them only when required, to save macro buffer space. 



Examples 



If macros #1 to #8 are defined and in this process use up all of the space in 
the buffer, then an attempt to define macro #9 and #0 results in those 
macros remaining null. Also, if the length of any macro from #1 to #7 is 
increased after filling the buffer, then macro #8 will be truncated. If the 
increase is more than the size of macro #8, macro #8 becomes null and 
macro #7 is truncated. 

WARNING! 

There are no warnings when truncation or nullification takes 
place. 

When you define a number of long macros, execute the MAC command to 
determine if the macros of the highest numbers are still intact. Using the 
general purpose registers in macros helps minimize the number of 
characters you need to use. 

Macros can be saved in the Emulator EEPROM. Refer to the LD and SAV 
(pages 5-27 and 5-25) commands for information on saving and reloading 
macros. 
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DISPLAY DEFINED MACROS 



Result 



Displays all defined macros in 
order #1-9,0 identified by three 
character sequences. 



Command 



MAC 



Examples 



>_1=DR;DIS CS:IP LEN 4; RUN 
>_2=DB; SS:SP LEN 10;a'Data_ptr 
>MAC 

_1=DR;DIS CS:IP LEN 4; RUN 
_2=DB; SS:SP LEN 10,-a'Data_ptr 
> 
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DEFINE/EXECUTE MACROS 



Command 



Result 



<0-9> = <com, exp, op> 



Defines the specified macro. 



<0-9> 



Executes the specified macro. 



Comments 



A space between the underscore, digit, or equals sign causes an error. 

There are shorthand notations for two macros: a comma as the first 
character on a line executes macro #1 and a period as the first character on 
a line executes macro #2. 



Examples 



Three macros are defined. Macros #1 and #2 can be executed 
independently. Macro #3 contains two nested macros (#1 and #2). 

Macros are not expanded when the macro is defined, so the definition of 
macro #3 may change, depending upon the content of macros #1 and #2. 

In this example, macro #2 uses a general purpose register as a counter. 



>_1=STP;DT 

>_2=GD1=GD1+1 

>_3=_1;_2 
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DEFINE/EXECUTE MACROS (cont.) 
Step and disassemble one instruction at a time. 



>_1= DB SS:SP LEN 20;RET;DIS CS:IP LEN 12 

Display the first 20H bytes on the stack, skip a line for readability and 
disassemble the next instructions that will be executed. 

There is no display on the screen and no syntax checking when a macro is 
defined. Errors are detected only when the macro is executed. 

Macro #3 is executed. 

> 3 
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CLEAR MACROS 



Command Result 

CMC Clears all defined macros. 

_<0-9>= Clears the specified macro. 

Examples 
Clear macro #1. 
> 1 = 
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The Repeat Operators 

The command repeat feature provides a way to repeat a command line a 
specified number of times or indefinitely. A repeat is indicated by an 
asterisk ( 0 ) at the beginning of a command line. The asterisk is followed 
by an optional decimal argument to specify the number of times to repeat 
the buffer contents. If the argument is zero, the buffer content is not 
executed. 



Examples 



>*5STP;DT 
>*5 STP:DT 
>* 5 STP;DT 



In these three equivalent examples, the STP;DT command is repeated five 
times. If the slash key is typed after the above example is input, the entire 
line is repeated, causing five more STP;DT commands to be executed. 

The repeat argument must be specified in decimal, not in hex, or as a 
variable, and there must be a space following the repeat count if the next 
character is a decimal digit. 

When the repeat argument is not specified it is assumed to be 
4,294,967,295 (232-1). a repeat can always be terminated by executing a 
system reset. However, this will also abort emulation, if it is in progress, 
without saving the state of the CPU. 

The TST variable terminates a repeats by setting it to zero with an 
expression in the command line. It is tested just before the command line 
is executed and if it has become zero, the command buffer is not executed 
and the repeat halts. 

To single step and disassemble until a specified address is reached: 



>*STP;DT; TST=CS: IP-$C324 
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If you are waiting for an overlay memory location to be cleared: 



>*STP;DT;TST=a87020 



You can use the system reset character to stop the repeat if the specified 
test conditions are never reached. 

The TST variable is set to all Is at the start of a repeat. This is necessary so 
that the register is in a known state at the start of a repeat loop. 

Repeats can also be terminated by the states of the limit (LIM) and index 
(IDX) registers. Just before execution begins, the values of LIM and IDX 
are compared. If IDX is greater than or equal to LIM, the repeat is 
terminated. The LIM register is initialized to the number of times the loop 
will execute, which is the decimal loop count you specified in the 
command line. 

IDX is a counter. It starts at zero and is incremented every time the repeat 
loop is executed. You may assign new values to these registers within 
repeat command lines if you wish. 

For example, if you need a decimal counter: 



>BAS IDX=#10 

>*#3 IDX 
#0 
#1 
#3 
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Initialize a block of memory to a decrementing count ending in zero, then 
display it. 



>BYM; M $1000 


$001000 $34 


>*4 LIM-IDX-1 


$001001 $C0 




$001002 $BF 




$001003 $00 




$001004 $21 


>M MMP-4 


$001000 $03 


>*4 


$001001 $02 




$001002 $01 




$001003 $00 




$001004 $21 


> 
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REPEAT COMMAND LINE 



Command Result 



/ Re-executes the previous 

command line. No |return| is 
necessary. 



Comments 



In order to be recognized as the repeat character, the slash must be the first 
character on a line. 



Examples 



This causes the system to single step and disassemble the instruction just 
executed. 



>STP;DT 

>/ 

>/ 

>/ 

>/ 



This causes the system to single step and disassemble memory starting at 
the instruction pointer (IP) location. 



>STP;DIS CS:IP LEN 10 
>/ 
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Symbols 

Symbol definitions allow you to refer to addresses and data values using 
names rather than numbers. Symbols are 32-bit integer values and sections 
are 32-bit ranges. Symbols and sections are sometimes collectively 
referred to as symbols. 

64K bytes of overlay memory are allocated for symbol definitions. To 
determine approximately how many symbols you can define, take the 
average symbol name length, add six and divide into 64K (64 x 1024). 

Symbols are not typed within the Emulator, so all symbols are global. This 
implies that a symbol and a section may not be defined using the same 
name. A symbol name may only be defined once. Section range values 
may not overlap. 

Symbols may be redefined by assigning a new value to the symbol name. If 
you want to reassign a symbol name to a section value, or if you want to 
change the range value of a section, you need to delete the symbol or 
section name before assigning the new value. 

Most compilers and assemblers create symbol tables from the symbols 
defined in the program. These symbols can be easily downloaded if you 
have a linker and converter that can create Extended Tekhex serial data 
records. See the SET command (page 5-3) for the serial data format 
variable. If you are going to download sections that have already been 
defined (perhaps from a previous download of the same file), purge all 
symbols or delete the section definitions from memory before 
downloading. If you do not, an error occurs when you attempt to redefine 
the value of a section, and the download aborts. 

Symbols may be used as parameters to any ESL commands. The only 
limitation on symbols is that they cannot be used meaningfully with the 
colon operator ( [7]). The single line assembler accepts symbols as address 
references and data values. 

Memory and trace disassembly display symbol names in place of absolute 
values for address fields. The following examples illustrate the difference 
when the same program is disassembled with and without symbol 
definitions. 
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Examples 



First, the symbols are defined. 



>SYM 




$00000480 


csr 


$00000486 


sh_csr 


$00001000 


CMND 


$00001022 


Tauc 


$00000004 


busy 


$00000002 


got_i t 


$00000080 


action 


$00004020 


es10 


>SEC 




$000010000 TO $00001 04F monitor 



The following example shows memory disassembly with symbol 
definitions. 



>GR0- 


=1000 LEN 2A 






>DIS 


GR0 






CMND 








1000 


F70680048000 


TEST 


WORD PTR csr, 0080 


1006 


74 F8 


JE 


SHORT CMND 


1008 


C606800402 


MOV 


BYTE PTR csr, 02 


100D 


C606860402 


MOV 


BYTE PTR sh csr, 02 


1012 


A02040 


MOV 


AL,BYTE PTR eslO 


1015 


800E860404 


OR 


BYTE PTR sh_csr,04 


101A 


8A268604 


MOV 


AH, BYTE PTR sh csr 


101E 


88268004 


MOV 


BYTE PTR csr, AH 


Tauc 








1022 


F70680048000 


TEST 


WORD PTR csr, 0080 


1028 


75 F8 


JNE 


SHORT Tauc 
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The following example shows trace disassembly with symbol definitions. 



>DTB 








>PARTIAL 


T.M. MAP: PASS 1 


DACC O 


FULL T.M. 


MAP: PASS 1 


PASS 


C 


SEQ# ADDR OPCODE MNEMONIC 


UrfcKANU rlcLUb bUb LTLLt UA I A 


SEC: mom" tor 






0038+CMND 








0038+0000 


F7068004800 


TEST 


l lADPt DTD r**>r* f\f\QCt 

WUKU r 1 K CSr,UUoU 


0034+0006 


74 F8 


JE 


SHORT CMND 


0033+0008 


C606800402 


MOV 


BYTE PTR CSr,U<£ 


0031+000D 


C606860402 


MOV 


BYTE PTR sn_csr,U£ 


0027+0012 


A02040 


MOV 


AL,BYTE PTR es10 


0026+0015 


800E860404 


OR 


BYTE PTR sh_csr,04 


0021+001A 


8A268604 


MOV 


AH, BYTE PTR sh_csr 


001 8+00 1E 


88268004 


MOV 


BYTE PTR csr,AH 


0014+Tauc 








0014+0022 


F70680048000 


TEST 


WORD PTR csr,0080 


0010+0028 


75 F8 


JNE 


SHORT Tauc 


0008+002A 


EBD4 


JMP 


SHORT CMND 


0005+CMND 








0005+0000 


F706 


TEST 


WORD PTR 0000, 06F7 
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The following example shows trace disassembly without section 
definitions. 



>DEL 'monitor 
FULL T.M. MAP: PASS 1 PASS 2 

SEQ# ADDR OPCODE MNEMONIC OPERAND FIELDS BUS CYCLE DATA 



0038 


CMND 








0038 


1000 


F7068004800 


TEST 


WORD PTR csr,0080 


0034 


1006 


74F8 


JE 


SHORT CMND 


0033 


1008 


C606800402 


MOV 


BYTE PTR csr,02 


0031 


100D 


C606860402 


MOV 


BYTE PTR sh_csr,02 


0027 


1012 


A02040 


MOV 


AL,BYTE PTR es10 


0026 


1015 


800E860404 


OR 


BYTE PTR sh_csr,04 


0021 


101A 


8A268604 


MOV 


AH, BYTE PTR sh_csr 


0018 


101E 


88268004 


MOV 


BYTE PTR csr.AH 


0014 


Tauc 








0014 


1022 


F70680048000 


TEST 


WORD PTR csr,0080 


0010 


1028 


75 F8 


JNE 


SHORT Tauc 


0008 


102A 


EBD4 


JMP 


SHORT CMND 


0005 


CMND 








0005 


1000 


F706 


TEST 


WORD PTR 0000, 06 F 7 
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The following example shows a memory disassembly with both sections 
and symbols purged, followed by a trace disassembly with no section or 
symbol definitions. 



>PUR 

>SYM;SEC 

> 



>DIS 


GR0 






1000 


F70680048000 


TEST 


WORD PTR 0480,0080 


1006 


74 F8 


JE 


SHORT 1000 


1008 


C606800402 


MOV 


BYTE PTR 0480,02 


100D 


C606860402 


MOV 


BYTE PTR 0486,02 


1012 


A02040 


MOV 


AL,BYTE PTR 4020 


1015 


800E860404 


OR 


BYTE PTR 0486,04 


101A 


8A268604 


MOV 


AH, BYTE PTR 0486 


101E 


88268004 


MOV 


BYTE PTR 0480, AH 


1022 


F70680048000 


TEST 


WORD PTR 0480,0080 


1028 


75 F8 


JNE 


SHORT 1022 



> 



>DTB 

FULL T.M. MAP: PASS 1 PASS 2 

SEQ# ADDR OPCODE MNEMONIC OPERAND FIELDS BUS CYCLE DATA 



0038 


1000 


F7068004800 


TEST 


WORD PTR 0480,0080 


0034 


1006 


74 F8 


JE 


SHORT CMND 


0033 


1008 


C606300402 


MOV 


BYTE PTR 0480,02 


0031 


100D 


C606860402 


MOV 


BYTE PTR 0486,02 


0027 


1012 


A02040 


MOV 


AL,BYTE PTR 4020 


0026 


1015 


800E860404 


OR 


BYTE PTR 0486,04 


0021 


101A 


8A268604 


MOV 


AH, BYTE PTR 0486 


0018 


101E 


88268004 


MOV 


BYTE PTR 0480, AH 


0014 


1022 


F70680048000 


TEST 


WORD PTR 0480,0080 


0010 


1028 


75 F8 


JNE 


SHORT 1022 


0008 


102A 


EBD4 


JMP 


SHORT 1000 


0005 


1000 


F706 


TEST 


WORD PTR 0000, 06F7 
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DISPLAY SYMBOLS 



Command 



Result 



SYM 

SYM <value> 



Displays all defined symbols. 

Displays all symbols assigned 
the specified value. 



, <symbol> 



Displays the value of the 
specified symbol. 



Examples 



>'sym = 1000 
>' start = 8000 
>'end = "start +37E 
>SYM 

$00001000 sym 

$00008000 start 

$0000837E end 
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DISPLAY SECTION 



Result 



Displays all currently defined 
sections and their values. 



Displays the section assigned the 
specified value. 

Displays the value of the 
specified section. 



Command 



SEC 



SEC <value> 



, <section> 



Examples 



>'sec = 1000 LEN IF 
> , im't_mod = 'start TO 'end 
>'RAM =$0000 TO SFFFF 
>SEC 

$00001000 TO $0000101 F sec 
$00008000 TO $0000837E initjnod 
$00000000 TO $0000FFFF RAM 
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SYMBOL DEFINITION 



Command Result 



'<symbol> =<value> Assigns the <value> to the 

specified symbol. 



Comments 



A space indicates the end of the symbol name. Symbol names can be up to 
64 characters long, but only 16 character names can be uploaded and 
downloaded. 

< symbol > Any combination of ASCII characters with decimal 
values in the range 33-126. This range includes all 
of the printable ASCII characters. 

<value> A 32-bit integer value or a range. 



Comments 



Be sure to end a symbol name with a space when assigning a value. If a 
space is not entered as the last character of a symbol name, the characters 
that follow are recognized as a continuation of the symbol. Once you type 
the single quote, the Emulator displays what you type in lower case letters, 
unless you explicitly type upper case letters (using the shift key). After 
you end the symbol name by typing a space character, the display reverts 
to all upper case letters. 

If a symbol name is assigned a value that is a range, it is assumed that you 
are defining a section. Section range values cannot overlap. 
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SYMBOL DEFINITION (cont.) 



Examples 



■testing! is recognized as the symbol. 



>' testing =GR0 



|'testing=GRQ] is recognized as the symbol name. The name will probably not 
be found and you will get an error message. 



>'testing=GRO 



>'section_X =10000 TO 1 FFF 

>'main_loop ='prog_start TO 'RAM_START-1 
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DELETE A SYMBOL OR SECTION 



Command 



Result 



DEL ><symbol> 
DEL , <section> 

Examples 



Deletes the specified symbol. 



Deletes the specified section. 



>SYM 
$00001000 Sym 
$00008000 start 

>DEL 'Sym; SYM 
$00008000 start 
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DELETE ALL SYMBOLS AND SECTIONS 



Command Result 



PUR Purges all symbols and section 

references. 



Comments 



Be sure to purge before downloading symbols that may already be defined. 
If you do not, an error occurs and the download is aborted. 



>SYM 






$00001000 


sym 




$00008000 


start 




$0000837E 


end 




>SEC 






$00001000 


TO $0000101 F 


sec 


$00008000 


TO $0000837E 


initjnod 


$00000000 


TO $0000FFFF 


RAM 


>PUR;SYM 


■SEC 




> 
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DISPLAY THE SOFTWARE REVISION DATES 



Command Result 



REV Displays the software revision 

dates for ESL and the firmware. 



Comments 



This command is valid only in pause mode. 

When you call AMC customer service, they ask you what software 
revisions are in your machine. This command gives you the necessary 
information. 



Examples 



>REV 










WED AUG 6 


08:50:26 


PDT 


1986 - 


ESL 2.2 


WED AUG 6 


16:50:26 


PDT 


1986 - 


FW 3.12 


> 
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DISPLAY A BLANK LINE 



Command Result 



RET Outputs a [return], linefeed 



Comments 



This command improves readability when displaying a lot of data. 



Examples 



Display two blocks of data, separating them with a blank line. 



>DB SS:SP LEN 20;RET;DB DS:DX LEN 20 

07FF76 02 06 - 20 46 40 62 00 00 12 20 .. F3b... 

07FF80 07 90 90 00 70 20 03 07 - 47 41 63 01 01 21 21 71 ....p ..GAc.Mq 

07FF90 01 90 06 21 12 13 ...!.. 

088060 01 02 03 04 05 06 07 08 - 00 20 21 22 23 24 25 26 !"#$%& 

088070 30 31 32 33 34 35 36 37 - 55 56 50 49 48 47 30 30 01234567UVPIH600 



5-124 



SECTION 6 

Table of Contents 

Target Commands 



Page 

INTRODUCTION 6-1 

EMULATION 6-2 

Starting Emulation 6-2 

Halting Emulation 6-3 

Using Registers In Run Mode 6-4 

Run Target Program 6-5 

Stop and Step Target System 6-7 

Load Reset Vectors 6-9 

Wait Until Emulation Break 6-11 

Reset 6-13 

MEMORY COMMANDS 6-15 

Display Memory Block 6-17 

Find Memory Pattern 6-19 

Fill Operator 6-21 

Verify Block Data 6-22 

Block Move 6-23 

Verify Block Move 6-25 

Load Overlay Memory 6-27 

Verify Overlay Memory 6-28 

Line Assembler 6-30 

Assembler Directives 6-32 



Section 6: Target Commands 



Table of Contents ( cont) 



Page 

Memory Disassembler 6-36 

MEMORY AND I/O MODES 6-38 

Memory Mode 6-38 

I/O Mode 6-38 

Enter Memory Mode 6-40 

Enter I/O Mode 6-43 

Exit Memory and I/O Modes 6-45 

Scrolling in Memory Mode 6-46 

I/O Mode Pointer 6-47 

Memory Mode Pointer 6-48 

DIAGNOSTIC FUNCTIONS 6-50 

Ram Tests 6-50 

Scope Loops 6-50 

Special Functions List 6-52 

Simple RAM Test, Single Pass 6-53 

Complete RAM Test, Single Pass 6-55 

Simple RAM Test, Looping 6-56 

Complete RAM Test, Looping 6-58 

Toggle Data At Address 6-60 

Peeks Into the Target System 6-62 

Pokes Into The Target System 6-63 

Write Alternate Patterns 6-65 

Write Pattern Then Rotate 6-67 

Write Data Then Read 6-69 

Force Null Operations 6-70 

Write Incrementing Value 6-71 

Read Data Over an Entire Range 6-72 

Cyclic Redundancy Check 6-73 

Read Target System Clock 6-74 

Target Cyclic Redundancy Check 6-75 



Section 6: Target Commands 



Table of Contents ( cont) 



Page 

Display Status of Several Status Lines 6-76 



Section 6 



TARGET COMMANDS 



Introduction 

The term "run mode" indicates that emulation has begun, that the 
microprocessor in the pod is running a program in the target. Pause mode 
is the opposite of run mode. The term "pause mode" indicates that 
emulation is not taking place. Generally, the target is the hardware and 
software that you are debugging. If there is no target hardware available, 
the target may be just a program, downloaded into the overlay memory. 
The microprocessor in the Emulator's pod replaces the microprocessor in 
the target. This gives the Emulator control of the processor, which in turn 
gives you use of the powerful Event Monitor System and the ability to see 
what is happening within the target system. 

The processor in the pod runs the target in real-time. All processor 
functions are available and valid during emulation. 
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Emulation 

STARTING EMULATION 

Enter run mode by executing any of four run commands. Two of the run 
commands load the reset vectors before entering run mode, and two of 
them enable the breakpoints in the Event Monitor System. Event system 
breakpoints may be enabled or disabled during run mode. Even when 
breakpoints are disabled, all other Event Monitor System functions are 
active. The reset vectors are defined by Intel as: 



CS = FFFFH 
IP = 0 
FLX = F002H 



The reset vectors cannot be loaded during run mode. RUN and RBK are 
typically used in run mode to disable and enable break points. The 
following table is a quick reference to the RUN commands. 





Load 


Break- 




Run 


Reset 


points 


Valid in 


Command 


Vectors 


enabled 


Run mode 


RUN 


NO 


NO 


YES 


RNV 


YES 


NO 


NO 


RBK 


NO 


YES 


YES 


RBV 


YES 


YES 


NO 



Many Emulator commands are valid during run mode, If you are unsure 
whether a command may be entered during run mode, just enter it. An 
error message is displayed if it is not valid. Some commands need to 
communicate with the pod processor, and many of these commands cannot 
be entered during run mode, because emulation must stop in order to 
complete the command. 
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The following commands may be entered in run mode, but do halt 
emulation briefly in order to read or write data to the target system or 
overlay memory. 



M 


- Memory mode 


HIQ 


- I/O mode 


3 


- Indirection operator 


DB 


- Display block of memory 


ASM 


- In- line assembler 


DIS 


- Memory disassembler 


NXT 


- Memory mode 


LST 


- Memory mode 



If there are target hardware problems, it may not be possible to enter run 
mode. In these cases, error messages are displayed describing the problem. 
If the error conditions do not clear, a reset may be required to bring the 
system back into command entry mode. 

HALTING EMULATION 

Emulation can be halted in one of four ways: 

1. Enter the stop emulation command, STP. When this 
command is entered during run mode, emulation is 
stopped and the values of the microprocessor registers are 
copied into Emulator memory. The current CS:IP and 
event monitor group number are displayed. 

2. The Event Monitor System can stop emulation if you 
have set up breakpoints and the breakpoints are enabled. 
When a breakpoint condition occurs, emulation is halted, 
the microprocessor registers are copied into Emulator 
memory, and the CS:IP and event monitor group number 
are displayed. 
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3. Issuing the reset character stops emulation. (See page 
4-25 and 5-4 for information on the reset character.) 
After the reset character is issued, the Emulator registers 
have the same value they had before emulation began. 
The operator should check those values or load the reset 
vectors (LDV) before restarting emulation. 

4. Emulation breaks automatically if the target program 
commits an access or write violation in overlay memory. 
(See page 5-54 for overlay memory access rights). The 
condition that caused the error is displayed. 

USING REGISTERS IN RUN MODE 

Setting and displaying the microprocessor registers during run mode can 
lead to unexpected results because the Emulator keeps a RAM image of the 
microprocessor registers. This image is copied to the processor whenever 
run mode is entered. The image is copied from the processor when 
emulation is stopped by the STP command or the Event Monitor System. 

Because of this, modifying these registers during run mode simply alters 
the Emulator's image of the registers. The Emulator does not copy the new 
values of the registers to the microprocessor. When emulation is broken, 
the current values of the microprocessor registers are copied and the RAM 
image is overwritten. Thus, you cannot dynamically change the value of 
the microprocessor registers while emulating, and a display register 
command entered after emulation has begun will show you the register 
values upon entry to emulation, not the values the registers currently 
contain. 
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RUN TARGET PROGRAM 



Command Result 



RBK Begins executing the target 

program at the current CS:IP 
memory location with 
breakpoints enabled. 

RBV Loads the restart vectors and 

begins executing the target 
program at memory location 
FFFFFOH with breakpoints 
enabled. 



RUN Begins executing the target 

program at the current CS:IP 
memory location with 
breakpoints disabled.. 

RNV Loads the restart vectors and 

begins executing the target 
program at memory location 
FFFFFOH with breakpoints 
disabled. 
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RUN TARGET PROGRAM (cont.) 



Comments 



Refer to Chapter 7, Event Monitor System, for breakpoint information. 

RNV and RBV are valid only in pause mode. 

All defined events are active while RBK and RBV are executing. 

Run commands containing a B indicate that Event System breakpoints are 
enabled. Run commands containing a V indicate that the reset vectors are 
loaded prior to entering run mode. 

Entering RNV is identical to entering LDV;RUN and entering RBV is the 
same as entering LDV;RBK. 
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STOP AND STEP TARGET SYSTEM 



Command Result 



R>STP From run mode the STP stops 

emulation and returns to pause 
mode. 

Displays the current CS:IP 
address and the Event Monitor 
System group number. 

>STP From pause mode, the STP 

command executes one 
instruction. To receive visual 
feedback, combine this 
command with a display 
command such as STP;DT. 



Comments 



[r>] indicates that the Emulator is in run mode. 0 indicates that the 
Emulator is in pause mode. 

See the Switch section under STI, page 5-22, for more information about 
stepping. 

Do not attempt to STP through an NMI vector fetch. This causes the 
emulator to hang. It is possible to STP through the NMI interrupt routine, 
but not the NMI vector fetch. All other vector fetches can be STP'ed 
through. 
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STOP AND STEP TARGET SYSTEM (cent.) 



Examples 



>STP;DR 
>STP;DT 

>STP;DIS IP LEN 4 
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LOAD RESET VECTORS 



Command Result 



LDV Loads the CPU reset vectors. 



Comments 



This command is valid in pause mode only. 

RNV and RBV also load the reset vectors, then enter run mode. The RST 
command resets the processor if in run mode and always loads the reset 
vectors. 

Intel defines the CPU reset vectors as: 



CS = FFFFH 
IP = OH 
FLX = F002H 



To verify that the reset vectors are loaded, execute the DR command or 
individually display the CS, IP and FLX registers. 

Refer also to Registers (page 5-64). 
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LOAD RESET VECTORS front.) 



Examples 



Display the registers, then load the reset vectors, clear the data registers, 
and verify the changes by redisplaying the register set. 



>DR 






















CS:IP FLX 


AX 


BX 


cx 


DX 


DS 


SI ES 


DI 


BP 


ss 


SP 


8000:1002 Z.. 


. 0100 


FF00 


1234 


0040 


cooo 


0000 D000 


0000 


0000 


ccoo 


0024 


>LDV;CLR;DR 


CS:IP FLX 


AX 


BX 


CX 


DX 


DS 


SI ES 


DI 


BP 


ss 


SP 


FFFF:0000 


. 0000 


0000 


0000 


0000 


cooo 


0000 D000 


0000 


0000 


ccoo 


0024 


> 
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WAIT UNTIL EMULATION BREAK 



Command Result 



WAI Delays executing the specified 

command until emulation is 
broken. 



Comments 



Usually this command is used to delay executing a display command until 
an event system breakpoint is reached. 

An event may never occur to bring the Emulator out of run mode. When 
this happens, use the system reset character to reset the system. (See pages 
4-25 and 5-4 for more information on the reset character.) 

After a reset, the delayed command is lost from the input buffer. 



Examples 



The Emulator disassembles a page of trace after a breakpoint is reached. 
Entering RBK;DTB, without the WAI command, results in a CANNOT 
EXECUTE COMMAND WHILE IN RUN MODE error. 



RBK;WAI ;DTB 
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WATT I INTO EMULATION BREAK (cont.) 

The Emulator runs until an access violation or a write violation is 
encountered, then displays a message pointed at by the BX register. 

RUN;WAI;DIA BX 
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RESET 



Command Result 



RST 



Resets pod microprocessor and 
loads the reset vectors. 



IP = FFFFH 

CS = 0 

FLX = F002H 



Comments 



The RST command can be issued from either run or pause mode. When in 
pause mode, the RST command resets the mecroprocessor and loads the 
reset vectors (LDV). While in run mode the microprocessor is reset in the 
target environment and emulation continues. This causes the 
microprocessor to start fetching instructions from the reset vector. RST 
does not affect the barget reset signal; therefore no target hardware is 
reset. This may cause problems when the target program tries to interact 
with unitialized hardware. 

CTRL Z differs from RST in that CTRL Z stops emulation if in run mode. 
Further, CTRL Z does not initialize the emulator registers. 



Examples 



In the example below, the Emulator is in run mode. The microprocessor is 
reset in the target environment and emulation continues. 



( continued ) 
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RESET (cont.) 



R> RST 
R> 



In the next example, the Emulator is in pause mode. The microrprocessor 
is reset and the reset vectors are loaded into the Emulator registers. 



>RST 

> 
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Section 6: Target Commands 



Memory Commands 

Memory commands allow you to modify and display memory in a number 
of different ways. "Memory" refers to memory in the target system or the 
Emulator's overlay memory. If the overlay memory is mapped (mapped 
memory will have the RW, RO or ILG attributes assigned to it), read and 
write accesses are directed to it. Mapped memory is modified by a 
memory command even if it is mapped as read only. If memory is 
unmapped, (memory with the TGT attribute assigned to it), memory 
command accesses are directed to the target system memory. Mapped and 
unmapped memory may be interleaved in any way you desire. See the 
Overlay Memory section (page 5-61) for details. 

The default data length affects most memory commands. There are two 
data lengths to choose from: byte mode (BYM) and word mode (WDM). 
Commands Commands that accept data parameters truncate the data 



entered to the current default data length. If you enter |fin o len 20,23F6 



and the default data length is byte mode, the find command truncates the 
data field to [?6] and searchs the range for that byte. Commands that 



display data use the current data length. 

Some memory commands may be executed during run mode. These 
commands halt emulation for a brief time in order to read from or write to 
memory. If memory commands are executed while in run mode, 
remember that you are not emulating in real-time. 
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The following table shows the target-related commands that can be 
entered in run mode and the commands that are affected by the default 
data length. 



Command 


Legal in 


Uses Default 




Run Mode? 


Data Length? 


OB 


YES 


YES 


FIN 


NO 


YES 


FIL 


NO 


YES 


BMO 


NO 


YES 


VBL 


NO 


YES 


LOV 


NO 


YES 


VFO 


NO 


YES 


ASM 


YES 


N/A 


DIS 


YES 


N/A 


M 


YES 


YES 


MIO 


YES 


YES 


a 


YES 


YES 
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DISPLAY MEMORY BLOCK 



Command 



Result 



DB < address range > 



Reads and displays the specified 
address range. 



DB 



Reads and displays one page of 
memory, starting at the last 
address displayed by any 
previous DB command. On 
power-up, this command 
displays a page of memory from 
address zero. 



DB <address> 



Reads and displays one page of 
memory, starting at the 
specified address. 



Comments 



The page length is defined by the CRT length parameter in the SET menu 
(see page 5-3). When displaying a block of data in byte mode, the ASCII 
representation of each byte is also displayed. 

The DB command provides an easy way to page through memory. Enter 
the DB <address> command to start reading memory at the desired 
address. Follow the display of this page of data with the DB command, 
and type a slash ( [7] ) (page 5-110). This repeats the DB command to 
increment the address and scroll through memory. 



( continued ) 
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DISPLAY MEMORY BLOCK ( cont.) 



If the display is longer than one page, the XON/XOFF characters can be 
used to start and stop scrolling (page 5-3). 

DB affects real-time operation when entered in run mode (see page 6-1). 



Examples 



Display 20 words pointed to by DS:DX. 



>WDM; DB DS:DX LEN 20 



Display a page of values pointed to by the value on top of the stack (see 
pages 4-9 and 4-13 for information on @ operator). 



>db ass:sp 



Display block in byte mode and word mode. 



>BYM 
















>DB 0 LEN 20 
















000000 80 48 


45 4C 


4C 4F 


80 80 - 


2F OF 


F1 F9 


5E 2F F6 F0 


.HELLO. ./. . . A /. . 


000010 OF 03 


F0 40 


OF 0C 


F0 40 - 


07 06 


F0 90 


OF 0C D8 00 


...a. ..a 


>WDM 
















>DB 0 LEN 2F 
















000000 4880 


4C45 


4F4C 


8080 - 


0F2F 


F9F1 


2F5E F0F6 




000010 030F 


40F0 


0C0F 


40F0 - 


0607 


90F0 


0COF 00D8 




000020 0FFF 


F9FF 


1FFF 


7FFF - 


3FFF 


BDFF 


1FFF FFFF 
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FIND MEMORY PATTERN 



Command 



Result 



FIN <range>, <data> 



Searches <range> for the data 
pattern. All occurrences of the 
pattern are displayed: 



$<add r ess>=$<data> 
> 



If the pattern is not found 
within the range: 



NOT FOUND 

> 



Comments 



Data may be either an integer or don't care value. The find command uses 
the default data length, regardless of the length of the <data>. (See SET 
parameter #26, page 5-7 for default data length in memory commands.) 



Refer also to the "don't care" description (page 4-11). 
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FIND MEMORY PATTERN (cont. ) 



Examples 



(Assume word mode.) To find a bit pattern using don't cares, use either of 
the following forms: 

>FIN 1000 TO 2FFF, 60XX 
or 

>FIN 1000 LEN 1000,6000 DC OFF 

(Assume byte mode.) Find the initialization data in the start module 
section. 



>FIN 'startmodule, 1 inituart 



Find any NOPs in the range. 



>FIN 100 TO 1000,90 
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FILL OPERATOR 



Command Result 



FIL <range>,<constant> Fills <range> with the 

<constant> data pattern. 

Comments 

This command is valid in pause mode only. 
<constant> must be an integer. 

The FIL command uses the default data length, regardless of the length of 
<constant>. (See page 6-15.) 

The FIL command can be verified using the VBL (Verify BLock) 
command (page 6-22). 

Examples 

Fill RAM with zero to initialize data space. 

>FIL 2000 LEN 50,0 

Fill RAM section with initialization data. 

>F I L ram, 1 initjdata 
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VERIFY BLOCK DATA 



Command Result 



VBL <address range>, <data> Verifies that <address range> 

contains the specified data. 



Comments 



This command is valid only in pause mode. 

The VBL command uses the default data length, regardless of the length of 
<data>. (See page 6-15.) 



Examples 



Verify that a range contains $3F. 



>VBL 0 TO 2000, 3F 




$00000004 - $00, NOT 


$3F 


$00000126 - $76, NOT 


$3F 


> 
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BLOCK MOVE 



Command Result 



BMO<range>,<address> Moves <range> to the new 

<address>. The current value 
of MMS specifies the relocation 
register used during the 
transfer. 



BMO<range>,<space>,<address> Moves <range> to the new 

<address>. The <space> 
argument specifies the memory 
mode status to use during the 
transfer. 



BMO<range>,<address>,<space> Moves <range> to the new 

<address>. The range is read 
from the space specified in the 
MMS register. The block is 
written to <space>. 



BMO< range>,<s pace> ,<add ress>,<s pace> 

Moves <range> to the new 
<address>. The range is read 
from <space> specified in the 
argument following the range. 
The block is written to < space > 
specified in the argument 
following the address. 
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BLOCK MOVE (cant.) 



Comments 

This command is valid in pause mode only. 

The following rules of thumb may make the numerous forms of this 
command less confusing. 

■ If there is no space specified for the source argument, 
MMS is always used (page 5-82). 

■ If no space is specified for the destination address, the 
source space is always used. 

■ A non-overlapping block move can be verified using the 
VBL command. 



Examples 



Move a range to a new location in data space. 



>MMS=DAT 

>BMO 100 TO 500, 1000 



or 



>BM0 100 to 500 f DAT, 1000 



Move 20 bytes from the stack in stack space to the value pointed to by the 
data register in data space. 



>BM0 SS:SP LEN 20, STA, DX, DAT 
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Command 



\BM<range>,<address> 



VBM<range>,<space>,<address> 



YBM<range>,<address>,<s pace> 



VERIFY BLOCK MOVE 



Result 



Verifies move of <range> to the 
new <address>. The current 
value of MMS specifies the 
relocation register used during 
the transfer. 



Verifies move of <range> to the 
new <address>. The <space> 
argument specifies the memory 
mode status used during the 
transfer. 



Verifies move of <range> to the 
new <address>. The range is 
read from the space specified in 
the MMS register. The block is 
written to the <space> specified 
in the argument following the 
address. 



Y~BM<range>,<space>,<ad dress> , <s pace> 

Verifes move of <range> to the 
new <address>. The range is 
read from <space> specified in 
the argument following the 
range. The block was written to 
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VERIFY BLOCK MOVE (cont.) 



the <space> specified in the 
argument following the address. 

Comments 

This command is valid only in pause mode. 

Verifies that a non-overlapping block move was successful. 
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LOAD OVERLAY MEMORY 



v^o in m silt* Result 



LOV <range> Moves data from the target 

system memory to the Emulator 
overlay memory in the specified 
address range. 



Comments 



The LOV command may not be entered during run mode. 

Refer to the VFO command, page 5-63, to verify the load overlay 
command. 

To load overlay memory from the target memory, a target system must be 
connected to the ESI 800 Emulator and overlay memory installed and 
mapped. 

To load a target memory range into the overlay memory at a different 
address, use the LOV command, then do a block move of the range. 

Refer also to the Overlay Memory section, page 5-61. 



Examples 



>L0V 80000 LEN 7FFF 
>L0V 'BOOT RANGE 
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VERIFY OVERLAY MEMORY 



Command 



Result 



VFO <range> 



Compares <range> in target 
memory to the same range in the 
overlay memory. 

If there are any differences, the 
address and data difference is 
displayed: 



<address> = XX NOT YY 



Comments 



XX is the data present in 
overlay memory. YY is the data 
at that location in the target 
system memory. 



This command is valid only in pause mode. 

Refer also to the Overlay Memory section, page 5-61, 
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VERIFY OVERLAY MEMORY (cont.) 



Examples 



To verify the two overlay loads in the LOV command section: 



>VFO 80000 LEN 7FFF 
>VFO 'BOOT RANGE 
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LINE ASSEMBLER 



Command 



Result 



ASM 



Assembly begins at the last 
address displayed during a 
previous assembly session. At 
power-up the start address is 
zero. 



>ASM 

**** 8086/88/186/188 LINE ASSEMBLER V2.6LA **** 
CSEG = XXXX 
0000 >X 
> 



ASM <arg> 



Assembly begins 
specified address. 



at the 



>ASM <address> 
**** 8086/88/186/188 LINE ASSEMBLER V2.6LA **** 
CSEG = XXXX 
0000 >END 

> 



END 

X 



Exits line assembly. 



oooo >x 
> 
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LINE ASSEMBLER (cont.) 



Comments 



Modification of the line assembler address is a two-step process. 

1. To change the segment, use the CSEG directive after 
entering line assembly mode. 

2. To change the offset, enter the assembler using a 16 bit 
address parameter, or use the ORG directive after 
entering the assembler. 

All 80186/88 instructions can be entered from line assembly mode. The 
instructions are converted to machine code and loaded into memory at the 
address specified in the prompt. 

The following pages describe the supported assembler directives. 
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ASSEMBLER DIRECTIVES 



Command 



Result 



CSEG 



Sets 64K byte code segment 
window: 



1012 >CSEG D400H 
1012 > 



ORG 



Sets 64K byte offset into the 
code segment window: 



1012 >ORG 3ACH 
03AC > 



END or X Exits line assembler to the 

command level: 



58FD 


>X 


**** 


END OF LINE ASSEMBLY **** 


> 
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DB 



ASSEMBLER DIRECTIVES (com.) 
Defines constant byte data: 



58FD >DB 1,2,3,4, "TEST", 0 
58FD 01 02 03 04 54 45 53 54 00 
5907 > 



DW Defines constant word data: 

(Note: odd length text strings 
are padded with nulls) 



58FD>DW 1, 


2,3,4, "TEST", 0 


58FD 0100 


0200 0300 0400 4554 


5453 


0000 


590D > 





PRE Toggles to preview mode 

(causes next instruciton to be 
disassembled): 



6590 


>PRE 


6590 


C6470234 MOV BYTE PTR 




[BX+2H] ,34H 



Toggles out of preview mode: 



6590 C6470234 MOV BYTE PTR 
[BX+2H] ,34H 

>PRE 
6590> 
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ASSEMBLER DIRECTIVES front ) 



EQU 



Defines/redefines local symbol 
(L0-L9): 



6590 >L3 EQU 7A44H 
6590 > 



or if symbolic debug hardware 
is installed: 



6590 > 'Unit EQU 0FDEOH 
6590 > 



L0,L1...L9 



Prints value of local symbol: 



756A >L3 

756A >L3 EQU 7A44h 
756A > 



'symbol 



Prints value of symbol. This is 
only valid if symbolic debug 
hardware is installed: 



756A >'Umt 

756A >'Unit EQU FDEOH 

756A > 
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ASSEMBLER DIRECTIVES (cont.) 



Disassembles one instruction at 
the current address: 



5D0A > 




5D0A 3306AD78 


XOR AX, WORD 


PTR 781DH 




5DE > 





Current assembler offset 
address. 

Within current line assembly 
segment. 

Outside current line assembly 
segment. 
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MEMORY DISASSEMBLER 



Command 



Result 



DIS <range> 



Disassembles and displays the 
data in the specified range. 



DIS <address> 



Disassembles one page of 
memory beginning at a 
specified address. 



DIS 



Disassembles and displays a 
page of memory beginning at 
the last address display during 
previous DIS command. At 
power-up this value is zero. 



Comments 



You should be familiar with 8086 assembly language programming and 

have the iAPX 86/88, 186/188 User's Manual by Intel. 

Page length is defined by the CRT length parameter in the SET menu 
(page 5-3). 
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MEMORY DISASSEMBLER (cont.) 



A disassembly command with an integer argument or no argument enters a 
special disassembly mode. The disassembly can be continued by typing a 
<space> or 1 return] . Exit disassembly by typing any other character. 

<space> Continues disassembling one 

line at a time. 



RETURN 



any char except <space> or 

RETURN | 



Continues disassembling one 
page at a time. 

Exits disassembly mode. 
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Memory and I/O Modes 

MEMORY MODE 

Memory mode allows you to view and modify memory using a simple 
scrolling scheme. Enter memory mode by executing the M command. The 
current address and associated data are displayed. If the first character 
entered on a memory mode command line is a [return], the next address 
and its data are displayed. If a value is entered before the [return], that 
value is written to the current address before displaying the next address. 
A list of up to nine values separated by commas may be entered after a 
memory mode prompt. This data is stored to consecutive addresses. 

The scroll direction is determined by two commands, NXT and LST. NXT 
(next) increments the address and LST (last) decrements the address. 
Entering either of these commands during run or pause mode sets the scroll 
direction and enters memory mode. The scroll direction can also be 
changed after you have already entered memory mode by executing the 
appropriate command. The scroll direction can be manually overridden at 
any time by using the period Q and comma Q keys. A period increments 
the address; a comma decrements it. 

The MMP register (Memory Mode Pointer) is always set to the current 
address being accessed. If memory mode is entered without specifying an 
address, the value in this register specifies the starting address. On power- 
up, MMP is set to zero. (For further information on MMP see pages 5-83 
and 6-48. 



I/O MODE 

I/O mode allows viewing and modification of the data in I/O address 
space. I/O mode is entered with the MIO command. Data is not 
automatically read from an I/O address on entry to I/O mode. Many I/O 
ports are "write only" ports, and trying to read from them may cause 
h ardware p roblems. In order to read data from an I/O port, you must enter 
a IreturnI as the only character on the line. The data is displayed, but the 
address is not automatically incremented. You must manually change the 
address while in I/O mode using the period and comma keys. A □ 
increments the address and a □decrements the address. Up to nine values 
separated by commas can be entered in response to the I/O mode prompt. 
All of the values in the list are written to the same I/O address. 
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Section 6: Target Commands 



The IOP register (I/O Pointer) is always set to the current I/O address 
being accessed. If I/O mode is entered without specifying an address, the 
value in this register will determine the starting address. On power-up, 
IOP is set to zero. (For further information on IOP, see pages 5-85 and 6- 
47. 
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ENTER MEMORY MODE 



Command 



Result 



M <address> 



Enters memory mode at 
< address >. The address and the 
data at that address are 
displayed preceding the prompt. 



M 



Enters memory mode at the last 
address examined in a previous 
memory mode session. 

The last address is stored in the 
MMP register, (Memory Mode 
Pointer). At power-up, this 
value is zero. 



Comments 



Exits memory mode. 



The M command affects real-time operation when entered in run mode 
(see page 6-15). 

Data displayed in memory mode can be in either byte or word lengths. Set 
byte mode (BYM) or word mode (WDM) before entering memory mode. If 
you are in word mode and enter a byte of data, the byte is padded with 
zeroes and a word is written. If you are in byte mode and enter a word of 
data, the value is truncated, and only a byte is written. (See page 4-24.) 

The MMP register is modified if you scroll to a new address while in 
memory mode. When you exit memory mode, MMP reflects the last 
address examined. 
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ENTER MEMORY MODE (cont.) 



When a [return] is entered as the first character on a line, the address is 
incremented or decremented and the new address and data are displayed. 
On power-up, the default scroll mode is toward increasing memory 
addresses. To change the scrolling direction use the NXT (forward) and 
LST (backward) commands. These can be entered in memory mode. If 
they are entered in pause mode, the scroll mode is set and memory mode is 
entered at MMP. 

The scroll mode can be overridden by using the period and comma keys. A 
□ increments the address and a Q decrements the address. 



To modify data at a memory location, enter the data and press [return 
The data is written to the current address and the next address and data are 
displayed. 

Data can be entered quickly using a list. A list can contain up to nine 
values separated by commas. See example below. 



Examples 



Set the MMP and use the NXT command to enter memory mode. Change a 
word of data and verify. 



>WDM; MMP=$FF000; NXT 
$0FF000 $1234 >1122 
S0FF001 $00FF >, 
$0FF000 $1122 >X 
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ENTER MEMORY MODE (cont.) 



Assume that address 1000H is the start of a data table and you want to 
write a short program to utilize that data. 

Initialize the data using a list. Then invoke the line assembler using MMP 
as the start address (page 6-30). 



>M 1000 




$001000 $00 >0, 1,2, 3, 4, 5, 6,7,8 




$001009 $00 >X 




>ASM MMP 




**** 8086/88/186/188 LINE ASSEMBLER 


V2.6LA **** 


CSEG = 0000 




1009 > 


Enter your program here. 




Use 'X' or 'END' to exit 




the line assembler. 
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ENTER I/O MODE 



Result 



MIO <address> 



Enters I/O mode at <address>. 
The port address is displayed, 
but no data is read until a 
IreturnI is entered as the first 
character on the line. 



MIO 



Enters I/O mode at the last 
address examined in a previous 
I/O mode session. 

This address is stored in the IOP 
(I/O Mode Pointer) register. At 
power-up, this value is zero. 

Exit I/O mode. 



Comments 



Affects real-time operation when entered in run mode (see page 6-15). 

The IOP is modified by scrolling to a new address while in I/O mode. 
When you exit I/O mode, the IOP reflects the last address examined. (See 
IOP, page 6-47.) 

To read from an I/O port, enter I/O mode using one of the above 
commands, and enter a [return | as the first character following the I/O 
mode prompt. The value of the current address is displayed. 
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ENTER T/O MODE fcnnt.) 



To write to the I/O port, enter the value and press 1 return 1 . The value is 
written and the current address redisplayed. 

Data can be entered quickly using a list. A list contains up to nine values 
separated by commas. All of the values in a list are written to the same 
address. 

Addresses are not automatically incremented or decremented. Scrolling 
the address in I/O mode must be done manually, by using the period to 

increment the address, and the comma to decrement the address. 



Examples 



Enter I/O mode, write to a port and verify. 



>MIO S2F00 
IO:$2F00 >$7F 
IO:$2F00 > 
IO:$2F00 $7F >X 



Set word mode and enter I/O mode at the last address, increment the 
address and read the data. 



>WDM; MIO 
IO:$2F00 >. 
IO:$2F01 > 
IO:$2F01 $05A6 >X 
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EXIT MEMORY AND I/O MODES 



Command Result 



X Exits memory or I/O mode. 
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SCROLLING IN MEMORY MODE 



Command 



Result 



RETURN 



Scrolls through memory 
addresses either one byte (8 bits) 
at a time, or one word (16 bits) 
at a time. 



LST 



The 1 return 1 key now 
decrements addresses in 
memory mode. 



NXT 



Comments 



The 



return 



key 



now 



increments (default mode) 
addresses in memory mode. 

Increments the address in 
memory mode. 

Decrements the address in 
memory mode. 



The "next" and "last" commands may be entered from pause, run, or 



- M. 7- 7 

memory mode. If entered from run or pause mode, the [return I key is set 
to increment or decrement and memory mode is entered at the current 
value of MMP. 

When a comma or period is entered in memory mode, this temporarily 
overrides the scrolling direction. 
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I/O MODE POINTER 



Command Result 



IOP Displays the current value of 

the I/O mode pointer. 

IOP = <exp> Assigns the value <exp> to the 

I/O mode pointer. 



Comments 



IOP is the last value examined while in I/O mode. If you enter I/O mode 
without specifying an address, the IOP value is used as the entry point. 

The default power-up value of the IOP register is zero. This register may 
be stored in EEPROM. 

The I/O mode pointer is modified by moving to a new address after 
entering I/O mode. When you exit I/O mode, the IOP reflects the last 
address examined. As with any register, the IOP can be used as a 
parameter for other commands (see Memory and I/O Modes, page 6-38). 



Examples 



Set the IOP and verify. 



>IOP=$1100;IOP 
$00001100 
> 
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MEMORY MODE POINTER 



Command 



Result 



MMP 



Displays the current value of 
the memory mode pointer. 



MMP = <exp> 



Assigns the value <exp> to the 
memory mode pointer. 



Comments 



MMP is the last value examined while in memory mode. If you enter 
memory mode without specifing an address, the MMP value is used as the 
entry point. 

The default power-up value of the MMP register is zero. This register 
may be stored in EEPROM. 

The memory mode pointer is modified if you change to a new address after 
entering memory mode. When you exit memory mode, the MMP reflects 
the last address examined. 

As with any register, the MMP can be used as a parameter to another 
command. (See memory and I/O modes, page 6-38.) 
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MEMORY MODE POINTER (cont.) 



Examples 



Set the MMP and verify. 



>MMP=$12330;MMP 
$00012330 



( continued ) 
6-49 



ESI 800 Emulator Reference Manual for 80186/188 Microprocessors 



Diagnostic Functions 

The diagnostic functions (also called special functions or SFs) are a group 
of utility routines and special tests. They are valuable for locating address, 
data, status or control line problems. There are two categories: 

■ RAM tests 

■ Scope loops 

For a complete list see the SF command (page 6-52). 

RAM TESTS 

The prewritten tests check that RAM is operating properly. They can be 
run on the target or overlay memory and may be executed in either byte or 
word mode. Byte or word mode must be specified prior to initiating the SF 
test. 

SF 1 and 3 are modeled after a study by Abraham, Thatte, and Narir 
entitled Efficient Algorithms for Testing Semiconductor Random-Access 
Memories [IEEE Transaction on Computers, vol. c-27, no. 6 June 1978]. 
Refer to this publication for background information on these two 
diagnostics. 

If you are going to test a large chunk of RAM, it may take a significant 
amount of time. If you attach a printer to the computer port and turn on 
the copy switch, you can let the test run while you do something else. The 
printer will record any errors that may occur in your absence. 

SCOPE LOOPS 

Scope loops are diagnostic routines built into the Emulator firmware for 
use when troubleshooting with an oscilloscope. The uses for these special 
functions range from locating stuck address data, status or control lines, to 
generating signatures using signature analysis equipment. Special 
Functions 4 through 12 are the memory scope loops and 24 through 32 are 
the I/O scope loops. 

The firmware is optimized so that the loops execute at maximum speed. 
This short cycle time allows the hardware engineer to review the timing of 
pertinent signals in the target system without using a storage oscilloscope. 
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Section 6: Target Commands 



All of these routines must be terminated by resetting the Emulator with the 
reset character (see pages 4-25 and 5-4). The scope loops can be executed 
in either byte or word mode. 

Memory scope loops access the memory space defined by the current MMS 
(Memory Mode Status) register. 

I/O scope loops access the target system's I/O space, 
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SPECIAL FUNCTIONS LIST 



Command Result 



SF Displays list of all available 

RAM tests, scope loops and 
miscellaneous tests. 



Examples 



>SF 




SF 0,<RANGE><CR> 


SIMPLE RAM TEST, SINGLE PASS 


SF 1,<RANGE><CR> 


COMPLETE RAM TEST, SINGLE PASS 


SF 2,<RANGE><CR> 


SIMPLE RAM TEST, LOOPING 


SF 3,<RANGE><CR> 


COMPLETE RAM TEST, LOOPING 


SCOPE LOOPS: {SELECT NUMBER FOR I/O 


LOOPS> 


SF 4 <24},<ADDRESS>,<PATTERN><CR> 


TOGGLE DATA AT ADDRESS 


SF 5 <25>,<ADDRESS><CR> 


READ FROM ADDRESS 


SF 6 <26>,<ADDRESS>,<DATA><CR> 


WRITE DATA TO ADDRESS 


SF 7 <27>,<ADDRESS>,<PATTERN><CR> 


WRITE PATTERN, THEN PATTERN COMPLEMENT 


SF 8 <28>,<ADDRESS>,<PATTERN><CR> 


WRITE PATTERN, THEN ROTATE 


SF 9 {29>,<ADDRESS>,<DATA><CR> 


WRITE DATA, THEN READ 


SF 10 <30>,<RANGE><CR> 


FORCE NOP TO INCREMENTING ADDRESS 


SF 11 <31},<ADDRESS>,<DATA><CR> 


WRITE INCREMENTING VALUE 


SF 12 <32},<RANGE><CR> 


READ DATA OVER ENTIRE RANGE 


MISCELLANEOUS: 




SF 13<CR> 


CRC CHECK OF EMULATOR FIRMWARE 


CLK <CR> 


DISPLAY TARGET CLOCK FREQUENCY 


CRC <RANGE><CR> 


CALCULATE CRC OF SPECIFIED RANGE 


CRE/CRO <RANGE><CR> 
> 


CALCULATE CRC OF EVEN/ODD BYTES ONLY 
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SIMPLE RAM TEST, SINGLE PASS 



locations within the specified 
range, then reads each location 
to verify the data. The 
following pattern sequence is 
used: 



Command 



Result 



SF 0, <range> 



Writes a test pattern to all 



Pattern 



Sequence BYM 



WDM 



1 0000 

2 0001 

3 0011 

4 0111 

5 1111 

6 1110 

7 1100 

8 1000 
9 



0000 
0000 
0000 
0000 
0000 
0001 
0011 
0111 



111 
111 
111 
111 
111 

110 
100 
000 



000 
001 
011 

111 
111 
111 
111 
111 



0000 



10 

11 

12 
13 
14 
15 
16 



1110 
1100 
1000 
0000 
0000 
0000 
0000 



( continued ) 
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SIMPLE RAM TEST, SINGLE PASS (cont.) 



Comments 

This command is valid in pause mode only. 

If a location is read that does not match the test pattern, a failure is 
reported. 

The address, correct data, and faulty data is displayed. 
If no failure is detected, the following prompt is displayed: 

TESTING RAM 
COMPLETE 

This is a single pass test. 
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COMPLETE RAM TEST, SINGLE PASS 



Command Result 



SF 1, <range> Writes, then reads, a test pattern 

to all locations in the specified 
range. Refer to Efficient 
Algorithms for Test Semi- 
conductor Random-Access 
Memories mentioned in the 
introduction to Diagnostic 
Functions for the test pattern. 



Comments 



This command is valid in pause mode only. 

If an error is detected, the associated address, correct data, faulty data, and 
test sequence number are displayed. The sequence number specifies which 
test in the complete list of tests caused the failure. 

This is a single pass test. 



Examples 



TEST FAILED AT $20; GOOD DATA-$00, BAD DATA-$01 SEQ#-$02 



An error is detected. 
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SIMPLE RAM TEST, LOOPING 



Command 



Result 



SF 2, <range> 



Writes a test pattern to all 
locations in <range>, then reads 
each location to verify the data. 
See SF 0 for test pattern. Each 
time the test is executed, the 
pass count is incremented and 
displayed on the screen. 



Comments 



This command is valid in pause mode only. 

If no failure is detected, the pass line is the only line displayed. It is 
continually updated, showing the number of times the test has been 
executed. 



SF 2, 0 TO 4 

YOU MUST RESET ME TO TERMINATE THIS FUNCTION 
PASS COUNT = $XXXX 
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SIMPLE RAM TEST, LOOPING (cont.) 



If a failure is detected, the problem address, correct data, and faulty data 
are displayed on the line after the pass number line, and the test continues. 



>SF 2,0 TO 4 




YOU MUST RESET ME TO TERMINATE THIS FUNCTION 




TEST FAILED AT $02; GOOD DATA - $FE, BAD DATA - 


$FF 


PASS COUNT = $0000 




TEST FAILED AT $02: GOOD DATA - $FE, BAD DATA - 


$FF 


PASS COUNT $0001 




until reset 





You must issue the reset character to terminate this test (see pages 4-25 and 
5-4). 
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COMPLETE RAM TEST, LOOPING 



Command Result 



SF3, <range> Writes a test pattern to all 

locations within <range>, then 
reads each location to verify the 
data. See SF 1 for test reference 
information. 



Comments 



This command is valid in pause mode only. 

During execution, a pass count is maintained and displayed on the screen. 

If no failure is detected, the pass line is the only line. It is continually 
updated, showing the number of times the test has been executed. 



>SF 3, 0 TO 2 
YOU MUST RESET ME TO TERMINATE THIS FUNCTION 
PASS COUNT = $XXXX 
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COMPLETE RAM TEST, LOOPING (cont.) 



If a failure is detected the associated address, the correct data, faulty data, 
and test sequence number are displayed. 



>SF 3, 0 TO 2 










YOU MUST RESET ME TO TERMINATE 


THIS FUNCTION 








TEST FAILED AT $02; GOOD DATA 


- $00, BAD DATA - 


$01 


SEQ # - 


02 


PASS COUNT $0000 










TEST FAILED AT $02; GOOD DATA 


- $00, BAD DATA - 


$01 


SEQ # - 


02 


PASS COUNT $0001 










until reset 











You must issue the reset character to terminate this test (see pages 4-25 and 
5-4). 
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TOGGLE DATA AT ADDRESS 



Command Result 



SF 4 <address>,<data> <data> is written to the 

specified address in the memory 
space defined by MMS. 

SF 24,<address>,<data> <data> is written to the 

specified address in I/O space. 

The user defined data pattern is 



written 


to 


< ad d re s s >, 


alternating with a data pattern 


of zeros. 






SEQ 


BYM 


WDM 


1 


00 


0000 


2 


XX 


XXXX (user data) 


3 


00 


0000 


4 


XX 


XXXX (user data) 









Comments 



These commands are valid in pause mode only. 

You must issue the reset character to terminate this test (see pages 4-25 and 
5-4). 
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TOGGLE DATA AT ADDRESS (cont.) 



Examples 



Assume you are in word mode (WDM). 



>SF 4, 2, $FFFF 
YOU MUST RESET ME TO TERMINATE THIS FUNCTION 



The data pattern written to address 2 is: 



oooo 

FFFF 
0000 
FFFF 
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PEEKS INTO THE TARGET SYSTEM 



Command 



Result 



SF 5,<address> 



Consecutively reads from the 
specified memory address using 
MMS as status space register. 



SF 25,<address> 



Consecutively reads from the 
specified I/O address. 



Comments 



These commands are valid in pause mode only. 

You must issue the reset character to terminate this test (see pages 4-25 and 
5-4). 



Examples 
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POKES INTO THE TARGET SYSTEM 



Command 



Result 



SF 6,<address> i <data> 



SF 26,<address>,<data> 



Comments 



Consecutively writes the user 
defined data pattern to the 
specified memory address using 
MMS as status space register. 

Consecutively writes the user 
defined data pattern to the 
specified I/O address. 



These commands are valid in pause mode only. 

You must issue the reset character to terminate this test (see pages 4-25 and 
5-4). 



Examples 



>SF 6, 10,$FFFF 

YOU MUST RESET ME TO TERMINATE THIS FUNCTION 



The data pattern written to address 10 is: 



( continued ) 
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POKES INTO THE TARGET SYSTEM (rant.) 



(BYM) 


(WDM) 


FF 


FFFF 


FF 


FFFF 


FF 


FFFF 
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WRITE ALTERNATE PATTERNS 



Command 



Result 



SF l,<address> > <pattern> 



Consecutively writes the user 
defined data pattern to the 
specified memory address using 
MMS as status space register 
followed by the complement of 
that data pattern to the same 
address. 



SF 21 i <address>,<pattern> 



Consecutively writes the user 
defined data pattern to the 
specified I/O address followed 
by the complement of that data 
pattern to the same address. 



Comments 



These commands are valid in pause mode only. 

You must issue the reset character to terminate this test (see pages 4-25 and 
5-4). 



Examples 



>SF 7, 10, 55 
YOU MUST RESET ME TO TERMINATE THIS FUNCTION 



( continued ) 
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WRITE ALTERNATE PATTERNS (cont.) 



The following data pattern is written to address 10: 



BYM 


WDM 


55 


0055 


AA 


FFAA 


55 


0055 


AA 


FFAA 
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WRITE PATTERN THEN ROTATE 



Command 



Result 



SF 8, <address> i <pattern> 



Consecutively writes the data 
pattern to the specified memory 
address using MMS as status 
space register, rotates the 
pattern 1 bit to the left, and 
writes to the same address. 



SF 28, <address>, <pattern> 



Consecutively writes the data 
pattern to the specified I/O 
address, rotates the pattern 1 bit 
to the left, and writes to the 
same address. 



Comments 



These commands are valid in pause mode only. 

You must issue the reset character to terminate this test (see pages 4-25 and 
5-4). 



Examples 



>SF 8,1000,05 
YOU MUST RESET ME TO TERMINATE THIS FUNCTION 



( continued ) 
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WRITE PATTERN THEN ROTATE (cont.) 

The following data pattern is written to address 10: 



BYM 


WDM 


05 


0005 


OA 


000A 


14 


0014 


28 


0028 


50 


0050 


AO 


00A0 


L 1 


U IhU 


82 


0280 




0500 




0A00 




1400 




2800 




5000 




A000 




4001 




8002 
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WRITE DATA THEN READ 



Result 



' M.M.M. MMM i*. MM V* 



SF 9, <address>, <data> 



Consecutively writes the 
specified data pattern to the 
specified memory address using 
MMS as status space register, 
then reads from that same 
address. 



SF 29, <address>, <data> 



Consecutively writes the 
specified data pattern to the 
specified I/O address, then 
reads from that same address. 



Comments 



These commands are valid in pause mode only. 

You must issue a reset character to terminate this test (see pages 4-25 and 
5-4). 



Examples 



>SF 9, 100,$FFFF 

YOU MUST RESET ME TO TERMINATE THIS FUNCTION 
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This page intentionally left blank. 
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WRITE INCREMENTING VALUE 



Command 



Result 



SF 11, <address> 



Consecutively writes a 
constantly incrementing value 
to the specified memory address 
using MMS as status space 
register. 



SF31, <address> 



Consecutively writes a 
constantly incrementing value 
to the specified I/O address. 



Comments 



These commands are valid in pause mode only. 

You must issue the reset character to terminate this test (see pages 4-25 and 
5-4). 



Examples 



>SF 11, 100 

YOU MUST RESET ME TO TERMINATE THIS FUNCTION 
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READ DATA OVER AN ENTIRE RANGE 



Command 



Result 



SF 12, < range > 



Consecutively reads from the 
specified memory address range 
using MMS as status space 
register. 



SF 32, <range> 



Consecutively reads from the 
specified I/O address range. 



Comments 



These commands are valid in pause mode only. 

The Emulator performs consecutive reads over the specified address range. 
The first read occurs at the starting address of the range. The address is 
then incremented for each additional read cycle. After the last address in 
the range has been read, the process starts again. 

You must issue the reset character to terminate this test. (See page 4-25 
and 5-4.) 



Examples 



>SF 12, 10 TO 20 

YOU MUST RESET ME TO TERMINATE THIS FUNCTION 
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CYCLIC REDUNDANCY CHECK 



Command Result 



SF13 



A CRC is calculated on the ES 
1800 internal PROM that 
contains the Emulator 
firmware. 



Comments 

This command is valid in pause mode only. 
This is an Emulator self -test. 
If a failure is detected, a CRC error is displayed. 
This is a single pass routine. 

When the text completes without an error, the command prompt ( 0 ) is 
displayed. 
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READ TARGET SYSTEM CLOCK 



Command 



CLK 



Examples 



>CLK 

CLOCK FREQUENCY = #2001 KHZ 
> 



Result 



Reads the target system clock 
and displays the value in KHz. 
The value is accurate to plus or 
minus 2 KHz. 
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TARGET CYCLIC REDUNDANCY CHECK 



Command 



Result 



CRC <range> 



The system calculates a cyclic 
redundancy check on all 
addresses in <range>. 



CRE < address range> 



Calculates a cyclic redundancy 
check on even addresses. 



CRO <address range> 



Calculates a cyclic redundancy 
check on odd addresses. 



Comments 



These commands are valid in pause mode only. 

The CRC command generates a cyclic redundancy check value over a user 
defined address range. Only the byte mode is used for this test. 

If code is split into two PROMs, with one even and the other one odd, the 
CRE/CRO operators allow you to do a cyclic redundancy check on each 
PROM. 

CRC calculations can be used to determine if RAM based data is being 
corrupted. Do a CRC over the data base and save the value. Then run the 
program and do the CRC over the range again. If the values do not match, 
data is being corrupted. The Event Monitor System can be set up to catch 
writes to the data base. 

The CRC algorithm is based on the polynomial X 16 +X 15 +X 2 +l. 
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DISPLAY STATUS OF SEVERAL STATUS LINES 



Command 



Result 



BUS 



The bus status is displayed: 



Comments 



The status of the following three bus lines is displayed: 



NMI 

ARDY 

SRDY 

INTO 

INT1 

INT2/INTA0 
INT3/INTA1 



Non-maskable interrupt 
Asynchronous ready 
Synchronous ready 
Interrupt 0 
Interrupt 1 

Interrupt 2 or interrupt 
acknowledge 0 

Interrupt 3 or interrupt 
acknowledge 1 



TEST 



Test input 
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DISPLAY STATUS OF SEVERAL STATUS LINES (cont.) 



Examples 



>BUS 














NMI ARDY 


SRDY 


INTO 


INT1 


INT2/INTA0 


INT3/INTA1 


TEST 


0 1 


0 


0 


0 


0 


0 


0 



0 indicates an inactive condition 

1 indicates an active condition 
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EVENT MONITOR SYSTEM 



Overview 

The ES1800's Event Monitor System provides extremely flexible system 
and breakpoint control, enabling you to isolate or break on any predefined 
series of events and then perform various actions. You control and 
monitor the target by entering commands that define events as logical 
combinations of address, data, status, count limit, and optional logic state 
probe inputs. When an event is detected, the ESI 800 can break emulation, 
trace specific sequences, count events, execute user supplied target 
routines, and trigger TTL outputs. 

WHEN/THEN control statements define events and the corresponding 
actions. There can be several actions for any event. The system only 
recognizes the first three letters of any word in a control statement (e.g., 
WHEN=WHE; THEN=THE). There can be many control statements in 
effect at any time. The Event Monitor System can also switch groups or 
states. There are four event groups available and the control statements 
and comparator values for any group are independent of those in other 
groups. 

You can enter Event Monitor System control statements while in run mode. 
You can also modify the event comparator values during run mode. These 
new statements and values will not go into effect until you stop and restart 
run mode. 
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The ESI 800 Event Monitor System monitors target information at the bus 
cycle level, including every read or write cycle that the microprocessor 
executes. The EMS "sees" every signal that can affect the target system. It 
can also monitor inputs from the logic state analyzer probe. 

The Intel 80186/80188 microprocessors multiplex address and data lines. 
The ESI 800 demultiplexes those signals so that the Event Monitor System 
"sees" all signals at the same time. The EMS essentially takes a picture of 
the microprocessor's signals at the beginning of every T4 state (refer to 
Intel manual, iAPX 86/88, 186/188 Users Manual). The information that 
is recorded into trace memory is the same information that the EMS is 
monitoring. 

The basic Event Monitoring System control statement is of the form: 
[Group] WHE[N] <event> THE[N] <action> 

Notice that the ESL command processor needs only the first three letters of 
the symbol. 

COMPARATOR REGISTERS 

There are eight comparator registers for each of the four event groups. 
These event registers are listed in the table below. The address 
comparators are used to detect discrete addresses or addresses inside or 
outside a specified range. The data comparators can detect specific data 
patterns and can ignore specified bit positions. The status comparators 
monitor all of the status signals from the microprocessor as well as some 
generated by the ESI 800. The status comparators can also ignore bit 
positions. The count limit register can be used to detect when an event has 
occurred more than a specified number of times. The logic state analyzer 
register can detect bit patterns in the inputs from the logic state probe. 
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Section 7: Event Monitor System 



The following table describes the available event comparator registers. 







Ci* to 

O 1 c. c 


Name by Group 




Description 


Type 


(bits) 


1 


2 


3 


4 


Address 1 


Range, I nt 


24 


AC1 or AC1.1 


AC1.2 


AC1.3 


AC1.4 


Address 2 


Range, Int 


24 


ALt or ACc.l 






AC2.4 


Data 1 


Don't Care, Int 


16 


DC1 or DC1.1 


DC1.2 


DC1.3 


DC1.4 


Data 2 


Don't Care, Int 


16 


DC2 or DC2.1 


DC2.2 


DC2.3 


DC2.4 


Status 1 


Don't Care, Int 


16 


S1 or S1.1 


S1.2 


S1.3 


S1.4 


Status 2 


Don't Care, Int 


16 


S2 or S2.1 


S2.2 


S2.3 


S2.4 


LSA 


Don't Care, Int 


16 


LSA or LSA.1 


LSA. 2 


LSA. 3 


LSA. 4 


Count 


Int 


16 


CTL or CTL.1 


CTL. 2 


CTL. 3 


CTL. 4 



ADDRESS COMPARATORS 

Address comparators may be assigned integer values or range values. 
Ranges may be either internal (IRA) or external (XRA). If a range is 
specified without IRA or XRA operators, the default range type will be 
IRA. The following are examples of valid address comparator assignments. 



>AC 1=2000 
>AC2=1000 LEN 20 
>AC2.2=XRA 1100 TO 1250 
>AC1.4 = IRA $FF006 LEN $FF 
>AC1.1 = asS:SP 
>AC2=' Symbol 
>AC1 =IP + 200 
>AC1.2 = IAC1.4 
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ODD BOUNDARIES 

The address comparators in the 80186 may need to be specially set up. The 
80186 is a 16-bit chip with a prefetch QUE and byte based instructions. 
This causes problems with breaking on instructions that occur on odd 
boundaries. 

This section describes three distinct conditions, and suggestions for 
resolving them. 

1 . 80 1 86 prefetches an instruction. 

When the 80186 prefetches an instruction, it outputs the 
even address. Both bytes are fetched, and the actual 
(odd) address of the byte in question is never seen. This 
means that you can't set the Event Monitor System to 
break on the odd address. 

2. 80 1 86 jumps to an odd address. 

When the 80186 jumps to an odd address, the odd address 
does appear on the bus, and only that byte is fetched. In 
this case, the Event Monitor System works as expected. 

3. Only the low byte is read. 

If only the low byte is read, the even address appears on 
the bus, and the odd byte is not read. This means you 
can't set the Event Monitor System to break on the odd 
address. 
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The ES 1800 Event Monitor System can be set up to resolve conditions 1 
and 3, and to guarantee correct operation in condition 2. 

Assume the byte in question is at $04001. This byte could be accessed by 
the address $04001 or $04000. If the address $04001 is on the bus, then the 
byte is accessed. If the address $04000 is on the bus, and the bus cycle is a 
16-bit cycle, then the byte is accessed. If the address $0400 is on the bus, 
and the bus cycle is an 8-bit cycle, then the byte is not accessed. 

This Event Monitor System setup handles this condition: 



AC1 =$04000 
AC2=$04001 
S1=WRD 

WHEN AC1 AND S1 OR AC2 THEN BRK 



AC1 contains the even address. SI is the word bus cycle condition. If both 
are true, the high or odd byte has been accessed. AC2 contains the actual 
odd address. If it is true, then the byte is always being accessed. If neither 
is true, then the byte is not being accessed. 
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DATA AND LSA COMPARATORS 

The data comparators monitor the data bus for specified patterns. The 
LSA comparators monitor the input pulses from the logic state probe. 

Data and LSA comparators may be assigned integer values or don't care 
values. Don't care values may be assigned in two ways. 

■ The first is to specify the value followed by the don't care 
mask 

■ The second is to specify the value using [x] in the don't care 
positions. 

The following are examples of valid data and LSA comparator 
assignments. 



>DC1=237F 

>LSA=5300 DC $FF 

>LSA.3 = 53XX 

>LSA = %1 10101 DC $FF00 

>DC2.2 = 42 DC %101 

>DC2 = GDO + $F 

>DC1.4 = 3'data table + 56 



STATUS COMPARATORS 

The status comparators are assigned values from the list of status constants. 
Many of these constants can be combined to specify a complex comparator 
value. The list on the next page shows the available mnemonics. Any of 
these statuses can cause events. 
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STATUS MNEMONICS 




ALT 


Alternate Data Access 


QD1 -6 


Queue ueptn ci-o? 


BYT 


Byte Access 


QF 


uueue r i usn uyc i e 


COD 


Code Access 


RD 


Read 


DAT 


Data access 


RIO 


Keaa iu status 


HLT 


Halt Status 


RM 


Keaa Memory status 


IAK 


Interrupt Acknowledge Status 


STA 


Stack Access 


IF 


Instruction Fetch Status 


TAR 


Target Access 


I OA 


10 Access 


UIO 


Un'te 10 Status 


MEM 


Memory Access 


WM 


Urite Memory Status 


NBC 


No Bus Cycle Status 


UR 


Urite 


NMI 


NMI Cycle 


URD 


Uord Access 


OVL 


Overlay Access 


DMA 


DMA Cycle 



The status mnemonic table shows which status values can be assigned to 
the comparators. You may assign a status comparator a single mnemonic, 
or you may combine a mnemonic from each of the columns 2-8 and any or 
all from column 9. Mnemonics are combined using an addition operator 
( 0 ) as a Boolean AND. 











STATUS MNEMONIC 


TABLE 






S1 


= TAR 


+ RD 


+ BYT 


+ MEM + ALT 


+ HLT 


+ QD1 + 


QF 


S2 


OVL 


UR 


URD 


I OA COD 


IAK 


QD2 


NMI 










DAT 


NBC 


QD3 


DMA 










STA 


RIO 


QD4 














RM 


QD5 














UIO 


QD6 














UM 


QD6 














IF 







Some examples of status comparator assignments: 



>S1=BYT 

>S2=0VL+RD+DAT 
>S1.3=UR+I0A 
>S2.4=RI0 
>S1.2=QF 
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BREAKING ON NMI 

Although it may be tempting to use the NMI status to break on NMI, do 
not use this status with the break action. Setting a breakpoint on an NMI 
fetch will cause the emulator to hang, requiring a Ctrl-Z to recover. To 
break on an NMI, set the event system to break on the starting address of 
the NMI interrupt routine. The NMI status may be used as a qualifier for 
other EMS actions. 



Figure 7. Status Translation Table 



STATUS TRANSLATION TABLE 



15 


14 


13 


12 


11 


10 


9 


8 


7 


6 


5 


4 


3 


2 


1 


0 




NMI 






X87 














QF 


MEM 
IOA 


TAR/ 
OVL 


RD 

WR 


BYT' 
WRD 



NMI = 0 



SEGMENT 

ALT=0 
STA = i 
COD = 2 
DAT = 3 



X87= 1 



CPU STATUS 

IAK=0 

RIO-! 
WIO = 2 
H LT = 3 
IF=4 

RM = 5 
WM = 6 
NBC = 7 



QUE DEPTH 

QDI = I 

QD2=2 
QD3 = 3 
QD4 = 4 
QD5 = 5 
QD6 = 6 



QF = 0 



EMULATOR STATUS 

MEM = I TAR = 1 RD=1 BYT = ] 

IOA = 0 OVL-0 WR-0 WRO = 0 



When you display the value of the status comparators, you will see a 32-bit 
don't care value rather than the mnemonics you originally assigned them. 
The Status Translation Table is provided to aid you in decoding the 
numbers back into the mnemonics. 



7-6 



Section 7: Event Monitor System 



The don't care mask is the value to the right of the DC. A "0" in a mask 
bit position enables the status bit in the same position on the left side of the 
DC, and a "1" in a mask bit position masks or disables the corresponding 
bit on the left side of the DC. 

Determine which bit positions are unmasked (those containing O's in the 
mask value). It may be easier to do this by setting the status comparator's 
display base to binary ( Ibas si = 2j ). Then refer to the translation table and 
find the unmasked bit positions. Look at the value contained on the left 
side of the DC and match it with the corresponding value shown 
underneath the bit position in the table. 



>S1 

$00000504 DC 0000B8F8 



All bits except bits 2, 8, 9, 10 and 14 are masked. Bit 14 is enabled and a 0 
is in the bit 14 of the status value, so NMI was entered. 

Bits 8,9, and 10 are enabled and there is a 101 (5) in those bits in the status 
value so RM was entered. 

Bit 2 is enabled and there is a 1 in bit 2 of the status value so TAR was 
entered. 

Therefore, the original input was: 



>S1=NMI+RM+TAR 



COUNT LIMIT COMPARATOR 

The count limit comparator, CTL, is used to detect when events have 
occurred a certain number of times. The CTL value for group 1 is loaded 
into a hardware counter which is decremented whenever the action CNT is 
executed (see Defining Action Lists, page 7-9). If a group switch occurs, 
the hardware counter can be loaded with the new group's count limit by 
executing the RCT (Reset Count) action. Otherwise, the hardware counter 
will not change its limit value when switching groups. 
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Defining Events 

The Event Monitor System is arranged in four independent groups. These 
groups provide a state-machine capability for debugging difficult 
problems. EMS control statements are associated with one of the four 
groups. If no group numbers are mentioned in the EMS control statement, 
the statement is assigned to group 1. There are two ways to override this 
default selection of group 1. You can begin the EMS control statement 
with a group number, or you can add a group number to any one of the 
event comparator names. For example: 13 when act then brk| is functionally 
the same as |when act .3 then brk[ . You cannot mix group numbers within a 



single EMS control statement. 



EVENT 

You can define an event to be some combination of address, data, status, 
count, and logic state probe conditions. Numerous Event Monitor System 
control statements may be entered and in effect simultaneously. 
Conflicting statements may cause unpredictable action processing. 
Parentheses are not allowed in event specifications. 

The NOT operator reverses the sense of the comparator output. NOT has 
higher precedence than either of the conjunctives. 



when aci and not pel then brk] means break whenever any data pattern other 



than that in DC1 is written to an address in ACI. 

AND and OR can be used where needed to form more restrictive event 
definitions. AND terms have higher precedence than OR terms. 



aci and dci or dc2| is the same as |aci and dcT] in one statement and [dcTI in 



another. I f you are looking for two different data values at an address, you 
would use |AC1 and dci or aci and PC2| . 

The OR operator is evaluated left to right and is useful for simple 
comparator combinations. For complex event specifications, OR 
combin ations can be replaced with separate EMS Control statements for 
clarity. |aci and si or ac2 and §2] is the same as |aci and si | and |ac2 and s2| . 
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Defining Action Lists 

The action list in a WHEN/THEN statement defines what the Emulator 
does when an event is detected. Actions are specified in an action list 
separated by commas. The action list may have one or more actions 
defined. 

Example 

<group> WHEN <event> THEN <action>,<action>, ... ,<action> 

The following table lists all possible actions. 



Event Monitor System Actions 



Action 


Description 


BRK 


Break emulation 


CNT 


Count bus cycle 


FSI 


Force special interrupt 


GRO n 


Change event group 


RCT 


Reset count value 


TGR 


Output trigger signal 


TOC 


Toggle count state 


TOT 


Toggle trace state 


TRC 


Trace bus cycle 



The TRC and TOT actions are described in the Tracing Events section. 
The CNT, RCT, and TOC actions are described in the Counting Events 
section. The FSI action is described in the Special Interrupt section. The 
GRO action is described in the Changing Event Groups section. The TGR 
action is described in the Trigger Signal section. The BRK is described in 
the Breaking Emulation section. 
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The EMS resolves conflicting EMS control statements. The TOC action in 
the first statement: 



>WHEN 


AC1 


THEN 


TOC 


>WHEN 


AC1 


THEN 


CNT 



is changed to CNT. 
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DISPLAY EVENT SPECIFICATIONS 



Result 



> V/ RM.M. M.M.M. 



DES Displays all of the 

WHEN/THEN statements 
currently active from all groups. 



DES < group number > Displays all of the 

WHEN/THEN statements and 
the comparator values for the 
specified group. 



( continued ) 
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DISPLAY EVENT SPECIFICATIONS front ) 



Examples 



Displays the statements and comparators for groups 1 and 2. 



>DES 1 ;RET;DES 2 

1 WHEN AC1 THEN BRK 
AC 1.1 = $007632 
AC2.1 = $000000 
DC1.1 = $0000 
DC2.1 = $0000 

51 .1 = $0000 

52 .1 = $0000 
LSA.1 = $0000 
CTL.1 = $0000 

2 WHEN S1 AND DC1 THEN CNT,TRC 
2 WHEN CTL THEN BRK 

AC1.2 = $000000 
AC2.2 = $000000 
DC1.2 = $40FF DC $00FF 
DC2.2 = $0000 

51 .2 = $0003 DC $FFFC 

52 .2 = $0000 
LSA.2 = $0000 
CTL. 2 = $0010 
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CLEAR WHEN/THEN STATEMENTS 



v O in in S II u Result 



CES Clears all of the WHEN/THEN 

statements currently active. 

CES < group number > Clears all of the WHEN/THEN 

statements for the specified 
group. 



Comments 



The comparator values are not affected by the CES command. 
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Breaking Emulation 

The BRK action stops emulation, returning the system to pause mode. 
When a break event is detected and emulation is broken, the current CS:IP 
and event group are displayed on the terminal. Emulation begins at the 
values displayed if the registers are not altered and you run or step 
following a break. When entering emulation, the Event Monitor System 
always begins looking for events specified in group 1 . 

Breakpoints stop program execution at specific times. After a break you 
can disassemble the trace memory, look at the LSA bits in the raw trace, 
check the CPU register values, or begin stepping through your code. 

Breakpoint actions may be enabled or disabled by selecting the appropriate 
run commands. If you enter emulation with the RBK or RBV run 
commands, breakpoints are enabled. If you enter emulation with the RUN 
or RNV commands, breakpoints are disabled, even if there are event 
statements specifying the BRK action. If emulation is entered with 
breakpoints disabled, you can enable them while running by entering the 
RBK command. If you enter emulation with breakpoints enabled, you can 
disable them while running by entering the RUN command. The RNV and 
RBV commands are not allowed during emulation. These commands load 
the reset vectors, which cannot be done during emulation. 

Breaking can also be qualified by a soft switch, BKX. This switch 
determines if breaks will occur on instruction execution, or on any access 
to an address, including prefetches (see page 5-13). 

Emulation may also be halted using the STP command. The RST 
command and the reset character also break emulation. 
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Examples 



Breaks when the instruction at address $3000 is executed. 



>0N BKX 
>AC1=3000 

>WHEN AC1 THEN BRK 
>RBK 
R> 



Trace only accesses between 1000 and 113C; break after ten accesses to this 
address range. 



>AC1=1000 


to 113C 


>CTL=#10 




>WHEN AC1 


THEN CNT.TRC 


>WHEN CTL 


THEN BRK 


>RBV 




R> 





Break when 55AA is written to I/O port A. 



>AC1='P0RT_A 

>DC1=55AA 

>S1=WI0 

>WHEN AC1 AND DC1 AND S1 THEN BRK 
>RBK 
R> 
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Tracing Events 



Events: 

TRC 
TOT 



The Event Monitor System can be set up to selectively trace bus cycles. If 
all of the conditions specified in the event portion of the WHEN/THEN 
clause are satisfied, the trace action, TRC, causes the specified bus cycle to 
be recorded into the trace memory. 

The toggle trace, TOT, allows you to turn tracing on and off. When a TOT 
event is detected, the trace is toggled to the opposite state, either on or off. 
You can specify a single event that starts and stops trace each time it is 
detected or specify any number of events that toggle trace on and off. 

If there are no event actions that specify TRC or TOT, all bus cycles are 
traced. If there is a TRC event, only qualified bus cycles are traced. If 
there is a TOT event, trace is off until the TOT is detected, then all bus 
cycles are traced until encountering another TOT event. 
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This table describes the trace conditions immediately before and 
immediately after a group change. 



Previous Group 


New Group 




Nothing Specified 


TRC 


TOT 


Nothing Specified 


Trace All Cycles 


Trace Onlv 
Qualified Cycles 


Trace Nothing 
Until First TOT 


TRC 


Trace All Cycles 


Trace Only 
Qualified Cycles 


Trace Nothing 
Until First TOT 


TOT (Not Tracing) 


Trace All Cycles 


Trace Only 
Qualified Cycles 


Trace Nothing 
Until first TOT 


TOT (Tracing) 


Trace All Cycles 


Trace Only 
Qualified Cycles 


Trace All Until 
first TOT 



This table describes initial trace conditions. 



Action Specified 


Trace Condition 


Nothing 


Trace All Cycles 


TRC 


Trace Only Qualified TRC events 


TOT 


Trace Nothing until TOT event 



( continued ) 
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Examples 



Trace only a specific subroutine. Break at the end of the routine. 



>AC1='Sub_start 
>AC2= ' Sub_end 
>WHEN AC1 THEN TOT 
>WHEN AC2 THEN BRK 

>RBK 
R> 
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Counting Events 



Registers: 






VaLue Type - 16 bit integer 


CTL 
CTL.1 




CTL. 2 




CTL. 3 




CTL. 4 




CTL=<EXP> 




CTL<.group>=<EXP> 




Events: 




CNT 




RCT 




TOC 





Events can be defined to selectively count bus cycles. There is one 
hardware counter and there are four count registers, one register for each 
group. The hardware counter is automatically loaded with the count limit 
register for group 1 when entering run mode. 

The count, CNT, action decrements the hardware counter. When the count 
reaches zero, the CTL event becomes true. If all other conditions specified 
in the WHEN/THEN clause are satisfied, the appropriate action is taken. 

Whenever the reset count, RCT, action is specified, the count comparator 
value for the specified group is loaded into the hardware counter. When 
switching groups, the current value of the hardware counter is passed 
along as a global count value unless a RCT action is specified in the same 
list of events that causes the group switch. 

The toggle count, TOC, command allows you to turn counting on and off. 
When a TOC event is detected, the count is toggled to the opposite state, 
either on or off. You can specify an event that starts and stops the counter 
each time it is detected or specify any number of events that toggle the 
counter on and off. 
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The current value of the counter cannot be read. You can only detect 
when you have reached a limit. 

This table describes the count conditions immediately before and after a 
group change. 



Previous Group 


New Group 




Nothing Specified 


CNT 


TOC 


Nothing Specified 


No Cycles Counted 


Court Only 
Qualified Cycles 


Count All Until 
First TOC 


CNT 


No Cycles Counted 


Count Only 
Qualified Cycles 


Count Nothing 
Until First TOC 


TOC (Not Counting) 


No Cycles Counted 


Count Only 
Qualified Cycles 


Count Nothing 
Until first TOC 


TOC (Counting) 


No Cycles Counted 


Count Only 
Qualified Cycles 


Count All Until 
first TOC 
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This table describes initial count conditions (always group 1). 



Action Specified 


Count Condition 


Nothing 


No Cycles Counted 


CNT 


Count Only Qualified CNT events 


TOC 


Count Nothing until TOC event 



Examples 



Count the times that the specified data is written to a specific address. 
Break if the data is written 20 times. 



>CTL=#20 
>S1=WR 

>AC 1=4020; DC1=$XXF3 
>WHEN AC1 AND DC1 AND S1 THEN CNT 
>WHEN CTL THEN BRK 
>RBK 
R> 
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Look for a read from a specific I/O port. After it is found go to group 2, 
load the group 2 counter register value into the hardware counter, and set a 
group 2 address comparator to count every bus cycle (all addresses). Break 
after 100 bus cycles. 



>AC1=' IOport 




>S1=RD 




>WHEN AC1 AND S1 


THEN GRO 2, RCT 


>CTL.2=#100 




>AC1.2=0 TO -1 




>2 WHEN AC1 THEN 


CNT 


>2 WHEN CTL THEN 


BRK 


>RBK 




R> 
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Trigger Signal 

The trigger signal is an output that is available from the BNC connector 
labelled TRIG on the back panel of the ESI 800 chassis and from pin 19 of 
the optional LSA pod. When a TGR event is detected, the trigger signal is 
asserted, and remains so for the duration of the specified bus cycle. This is 
asserted as a TTL-level high signal. If a trigger event is specified for more 
than one consecutive bus cycle, the signal stays high for the duration of the 
consecutive bus cycles. 

The trigger signal can be used as a pulse output for triggering other 
diagnostic equipment. It can also be used with a counter/timer for timing 
subroutines. 



Examples 



Trigger a scope when reading data from a UART. 



>AC1='DATA_P0RT 
>S1=RIO 

>WHEN AC1 AND S1 THEN TGR 



Determine the duration of a subroutine using the trigger pulse. The trigger 
pulse can be the input to a counter/timer or a scope. The duration of the 
subroutine can be determined from the pulse width displayed on the scope 
or the counter/timer readout. 



( continued ) 
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>AU I —c. jUU 


Start of subroutine 


*kftp1 O— ftrl J.7QC 


End of subroutine 


>DC1.2=XXXX 


Detect any data pattern 


>WHEN AC1 THEN TGR, GRO 2 


Go to group 2 when subroutine is entered 


>2 WHEN DC1 THEN TGR 


Trigger during all cycles while in group 2 


>2 WHEN AC1 THEN GRO 1 


Go back to group 1 when last instruction 


>RUN 


in subroutine is executed. 


R> 
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Special Interrupts 



Registers: 




SIA 


Value Type - 32 Bit Integer 


Events: 




FSI 





The force special interrupt action, FSI, allows you to jump to a specified 
address when a specific event is detected. 

The special interrupt address register, SIA, should be set prior to entering 
the run mode if you are using the FSI event. It defines the address your 
program vectors to when the FSI is executed. 

When an FSI event is detected, an |fsi active! message is displayed on the 
screen. You may also see some unusual cycles in the trace memory at the 
address where the FSI occurred. These are internal cycles that are traced 
as the execution address is changed. These internal cycles are not purged 
from trace memory. 

The FSI event can allow you to patch to your code fast. It can also allow 
you to write soft shutdown routines for machinery that cannot be halted 
using a simple breakpoint. 

The FSI routine residing at the SIA address should terminate with an 
interrupt return (IRET) instruction. Execution resumes at the address 
immediately following the instruction that caused the FSI. If this is a soft 
shutdown, you will probably define a breakpoint at the IRET instruction. 



( continued ) 
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Examples 



Make a patch using overlay memory 



>MAP 1000 

>AC1=8F36 

>WHEN AC1 THEN FSI 

>SIA=1000 

>ASM SIA Single Line assembler - patch code 

can be assembled here. 



>RUN 
R> 



Assume the program needs to break at a certain address, but the machine 
cannot be turned off until a soft shutdown routine is executed. Set SIA to 
the address of the soft shutdown routine. Use an FSI action at the break 
address, then set a breakpoint at the end of the soft shutdown routine. 



>SIA='SHUT_down 
>AC1=$7F4E2 
>AC2='SHUT_down + 4E 
>WHEN AC1 THEN FSI 
>UHEN AC2 THEN BRK 
>RBK 
R> 



7-26 



Section 7: Event Monitor System 



Changing Event Groups 

The four event groups allow you to detect sequential events. When 
emulation is entered, event monitoring always begins in group 1. The 
example below describes a common use of the EMS group structure. 

You may want to trace a subroutine after it has been called by Module A or 
Module B, but not if it has been called from Modules C, D, or E. In this 
case, define the address comparators in group 1 to the address ranges of 
Modules A and B. When either of these modules is encountered, switch to 
group 2 and look for the subroutine. After tracing the subroutine, switch 
back to group 1 . Turn on the break on instruction execution (BKX) switch 
so that prefetching instructions do not trigger event actions. 



>'Module_A =1240 LEN 246 
>'Module_B =8750 LEN 408 
>'Sub_X =8934 LEN 56 
>ON BKX 

>ACl='Module_A 
>AC2='Module_B 

>WHE AC1 OR AC2 THE GRO 2 

>ACl.2='Sub_X 

>2 WHEN AC1 THE TRC 

>2 WHE NOT AC1 THE GRO 1 
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The TRC/TOT and CNT/TOC actions interact in a specific way when 
event groups are switched. The following state transition tables describe 
the actions taken when each of the different event combinations are 
specified. 





New Group 


Previous 
Group 


Nothing 
Specified 


TRC 


TOT 


Nothing 
specified 


Trace all 
cycles 


Trace only 
qualified cycles 


No trace 
until first TOT 


TRC 


Trace all 
cycles 


Trace only 
qualified cycles 


No trace 
until first TOT 


TOT OFF 
(not tracing) 


Trace all 
cycles 


Trace only 
qualified cycles 


No trace 
until first TOT 


TOT ON 
(tracing) 


Trace all 
cycles 


Trace only 
qualified cycles 


No trace 
until first TOT 




Previous 
Group 


New Group 


Nothing 
Specified 


CNT 


TOC 


Nothing 
specified 


No cycles 
counted 


Count only 
qualified cycles 


No count 
until first TOC 


CNT 


No cycles 
counted 


Count only 
qualified cycles 


No count 
until first TOC 


TOC OFF 
(not counting) 


No cycles 
counted 


Count only 
qualified cycles 


No count 
until first TOC 


TOC ON 
(counting) 


No cycles 
counted 


Count only 
qualified cycles 


No count 
until first TOC 
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List of Commands 



Command 



Description 



Page 



> 

R> 

[RETURN 
/ 



CTRL Q 
CTRL R 
CTRLS 
CTRL X 
CTRL Z 
ESC ESC 

$ 
# 



Pause mode prompt 4-23 

Run mode prompt 4-23 

Return key 4-6 

Repeat previous command line 4-7, 

Statement separator 4-6 

Repeat command 4-6 

Start screen scrolling (can be changed) 4-25 

Reprint current line 4-25 

Stop screen scrolling (can be changed) 4-25 

Delete line 4-25 

Reset the emulator (can be changed) 4-25 
Escape transparent mode (can be changed)¥-25 



Hexadecimal 
Decimal 



4-12 
4-12 
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Command 


Description 


Page 


% 


Ulllul y 


4-12 




Octal 


4-12 


= 


Equals 


4-12 


0 


Parentheses 


4-13 


@ 


Indirection 


4-9 


* 


Multiplication 


4-17 


/ 


Division 


4-17 


+ 


Addition 


4-17 


- 


Subtraction 


4-17 


- 


Negation 


4-15 


& 


Bitwise AND 


4-17 


A 


Bitwise OR 


4-17 


<< 


Shift left 


4-17 




Shift rieht 


4-17 


t 

• 


Tnvpr^p hitwi^p NOT 

XU V vl OV) UHW low 1 ~ w X 


4-15 


» 
• 


Intel Segment/offset operator 


4-9 


* 
* 


Memory block attribute 


6-15 


• 


Increment Memory Mode address 


6-38 


* 


Execute macro #2 


5-104 




Decrement Memory Mode address 


6-38 




Execute macro #1 


5-104 


• 


Help menu 


4-20 


• 


Error query 


4-7 




Define/execute macro 


5-104 


J 


Symbol definition (single quote) 


4-10 
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Command 


Description 


Page 


ABS 


Absolute value 


4-16 


AC1, AC2 


Address comparators 1 and 2 


7-3 


ALT 


Alternate data access 


7-5 


AND 


Logical event AND 


4-15 


ASM 


x * t ■% 

Line assembler 


6-30 


AX, AL, AH 


Accumulator (low and high) 


5-70 


BAS 


Set/display base value 


5-80 


BKX 


Break on instruction execution 


5-13 


BMO 


Block move 


6-23 


BP 


Base pointer 


5-70 


BRK 


Break 


7-14 


BUS 


x-x • 1 . . (* f * 

Display status of lines 


6-76 


TT%TK7~ T"»TT X"»"W"T 

BX, BL, BH 


Base register (low and high) 


5-70 


BYM 


Byte mode 


4-24 


BYT 


Byte access status 


7-5 


CCT 


Computer port control 


5-36 


CD 


Overlay enable for code access 


5-61 


CDH 


Clear DMA halt switch 


5-14 


CES 


Clear WHEN/THEN statements 


7-13 


CK 


Internal/external clock selection 


5-14 


CLK 


Read target system clock 


6-74 


CLM 


Clear memory map 


5-60 


CLR 


Clear microprocessor data registers 


5-74 


CMC 


Clear macros 


5-106 


CNT 


Count event 


7-19 


COD 


Code status 


7-5 
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Command 


Description 


Page 


COM 


ASCII communication 


5-48 


CPY 


Copy switch 


5-16 


CRC/CRE/CRO 


Target cyclic redundancy check 


6-75 


CS 


Code segment 


5-70 


CTL 


Count limit 


7-7 


CX, CL, CH 


Count register (low and high) 


5-70 


DAT 


Data access status 


7-5 


DB 


Display memory block 


6-17 


DC 


Don't cares 


7-4 


DC1,DC2 


Data comparators 1 and 2 


7-4 


DEL 


Delete symbol/section 


5-120 


DES 


Display WHEN/THEN statements 


7-11 


DFB 


Set/display default base value 


5-86 


DI 


Destination index 


5-70 


DIA 


Display ASCII character string 


5-52 


DIS 


Display disassembled memory 


6-36 


DM 


Display memory map 


5-55 


DMA 


DMA cycle 


5-67 


DME 


Enable DME switch 


5-17 


DNL 


Download 


5-38 


DR 


Display microprocessor registers 


5-74 


DRT 


Display raw Trace Memory 


5-94 


DS 


Data segment 


5-70 


DT 


Disassemble Trace Memory 


5-98 


DTA 


Overlay enable for data access 


5-61 
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Command Description Page 

DTB Disassemble Trace Memory backward 5-101 

DTF Disassemble Trace Memory forward 5-101 

DX, DL, DH Data register (low and high) 5-70 

END Line assembler exit 6-32 

ES Extra data segment 5-70 

FIL Fill memory with constant data 6-21 

FIN Find byte or word 6-19 

FLX, FLL, FLH Flags register (low and high) 5-70 

FSI Force special interrupt 7-25 

FSX Force special interrupt on instruction 

execution (switch) 5-18 

GDO-7 General purpose data registers (0-7) 5-88 

GRO-7 General purpose range registers (0-7) 5-90 

GRO Event monitor system group 7-27 

HLT Halt status 7-5 

IAK Interrupt acknowledge status 7-5 

IDX Repeat index register 5-707 

IF Instruction fetch status 7-5 

ILG Illegal memory access attribute 5-57 

IOA 10 access status 7-5 

IOP IO mode pointer 6-47 

IP Instruction pointer register 5-70 
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Command 


Description 


Page 


IRA 


Internal ranee 

JLUlvl XXCXX X Ullgv 


7-3 


LD 


Load EEPROM data 


5-27 


LDV 


Load vectors 


6-9 


LEN 


Length (specifies range) 


4-11 


LIM 


Reoeat limit register 

JL >. V p VU k 111111 L- 1 VftlO VV X 


5-107 


LOV 


Load Overlav Memorv 


5-62 


LSA 


Locic State Probe comoarator 

i— <v^iv kjucvkw i x w l/v wuiiipmuiui 


7-2 


LST 


Decrement address in memorv mode 

X/vvl vlllvlll UUUl vJJ XXX XXXVXXXWX V lllUUv 


6-46 


M 


Enter memory mode 


6-40 


MAC 


Display macros 


5-103 


MAP 


Define overlay memory map 


5-56 


MEM 


Memory status 


7-5 


MIO 


Tenter T /O mnHp 


6-41 


MMP 


Mpmnrv mnHp nnititpr 
lviciiiui y uiuuc jjuinici 


J O J 


MMS 


Memorv mode statu** 




MOD 


Modulo 


4-17 


NBC 


No hns ovoles status 


7-5 


NMI 


NJMT cvrle status 


7-5 


iNvl 1 


Logical event nui 


4-15 


NXT 


Increment address in memory mode 


6-46 


OFF 


Display/disable switches 


5-9 


ON 


Display/enables switches 


5-9 


OR 


Logical event OR 


4-15 
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Command Description 

OVE 
OVL 

PCB 
PUR 

QD1-6 
QF 

RBK 
RBV 
RCS 
RCT 
RD 
RDY 
RET 
REV 
RIO 
RM 
RNV 
RO 
RST 
RUN 
RW 

S1,S2 
SAV 
SEC 
SET 



Page 



Overlay memory enable 5-61 

Overlay memory status 7-5 

Display PCB registers 5-77 

Clear symbolic memory 5-121 

Queue depth (1-6) status 7-5 

Queue flush cycle status 7-5 

Run with breakpoints 6-5 
Load vectors and run with breakpoints 6-5 

Read chip select switch 5-19 

Reset count limit 7-19 

Read status 7-5 

Ready switch 5-20 

Display return and line f eed 5-124 

Display software revisions 5-123 

Read I/O status 7-5 

Read memory status 7-5 

Run with new vectors 6-5 

Read only attribute 5-57 

Reset 6-13 

Run emulation 6-5 

Read/write attribute 5-56 

Status comparators 1 and 2 7-5 

Save EEPROM data 5-25 

Display section 5-777 

Set/display system parameters 5-3 
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Command 


Description 


Page 


or 


Ulapidy bpcCld.1 1 Uii^liuii menu 


6-52 




iv /\ ivi icbib 


6-52 


bJb 4-12 


opeciai t unctions ^memory; 


A- 5? 


err i a 1 1 


opeciai I unctions vi/vjj 


n"- 5? 




oource inaex register 


j — / u 


SIA 


Special interrupt address 


7-25 


SP 


Stack pointer register 


5-70 


ss 


Stack segment register 


5-70 


STA 


Stack data status 


7-5 


STI 


Step through interrupts 


5-22 


STP 


Step and stop 


6-7 


SYM 


Display symbols 


5-116 


TAD 
1 AK 


Idlgcl dvtCob olaLUo 


5-96 


TfT 


Tprminnl nnrt rontrnl 


5-35 


X tLXJ — X 


Timpr switf*hpc 

J. 11UC 1 SWllVHCS 


5-23 


1 vrlx 


xiiiaVic nigger uuipui 


7-21 

/ aC J 


1 vr 1 


ldrgci iiiciiiury diuiuuic 


5-57 


THE 


THEN used in event statements 


7-1 


TO 


To 


4-11 


TOC 


Toggle counting 


7-19 


TOT 


Toggle trace memory 


7-16 


TRA 


Transparent mode 


5-33 


TRC 


Trace event 


7-16 


TST 


Test register for repeats 


5-92 
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Command 


Description 


Page 


TTPT 




5-44 


UPS 


Upload symbols 


5-46 


\ dL 


V Vlily Diu^X uaia 




VUJV1 


veriiy diock move 


6-75 


v r yj 


^/^fi^Ny rwAflciv oocjinct tdfOPt 
v ci li y uvciicty d-gdiiiot idigC/L 


6-28 


Vr Y 


veriiy serial aata 




WAI 


Wait until emulation is broken 


6-11 


WDM 


Word mode 


4-24 


WHEN/THEN 


WHEN/THEN Statements 


7-9 




write L\j staius 


7- 5 


TT 1V1 


TTlllC lUCiUUl jr 3 Id 1 113 


7-5 


WR 


Write status 


/-J 


WRD 


Word status 


7-5 


X 


Don't care 


7-4 


X 


Exit memory mode 


6-32 


XRA 


External range 


7-3 
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ERROR MESSAGES B-l 

Target Hardware Error Messages B-l 

Hold Acknowledge/Bus Granted B-l 

No Bus Cycles B-2 

No Clock B-2 

Processor Halted B-2 

Processor Waiting B-3 

Reset Asserted B-4 

Emulator Hardware Error Messages B-4 

Pod CPU Not Initialized B-4 

Pod CPU Not Responding B-5 

System Reset Error B-5 

Target Software Error Messages B-5 

Memory Access Violation B-5 

Memory Write Violation B-5 
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ERROR MESSAGES 



Error Messages 

Error messages are divided into 3 categories: 

1 . Target Hardware 

2. Emulator Hardware 

3. Target Software 

TARGET HARDWARE ERROR MESSAGES 



HOLD 

ACKNOWLEDGE /BUS 
GRANTED 



This message is displayed when a hold 
acknowledge has been asserted for longer 
than 2.2 ms. When the microprocessor 
regains control of the bus, the message is 
removed. This message is caused by one of 
two conditions: When a DMA (direct 
memory access) controller takes over the 
bus by asserting the hold line, or when the 
microprocessor is running in a 
multiprocessor environment. This message 
is generally not an error message but rather 
a statement of what the processor is doing. 
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NO BUS CYCLES This error message indicates that no ALE's 

(Address Latch Enable) were detected for 
at least 2.2 ms or longer, and no other error 
conditions are found. 

When no ALE's are detected the controller 
checks for other fault conditions, including 
proper target VCC, a functional clock, and 
whether the processor is halted, waiting, 
reset or the bus is granted. If any of these 
other conditions exist then the appropriate 
message for that condition is displayed. If 
no other fault condition is found, the NO 
BUS CYCLES message is displayed. 

NO CLOCK The microprocessor must have a clock 

frequency within the range of 1 .2 Mhz to 9 
Mhz or the message NO CLOCK is 
displayed. 

If there is no clock from the target, the user 
is given the option of selecting an internal 
clock when the Emulator is powered up (see 
page 5-9). However after an external clock 
has been selected and the NO CLOCK 
message is displayed, the only way to return 
to an internal clock is to reset the system. 

PROCESSOR A halt (HLT) instruction has been executed 

HALTED and the microprocessor has remained halted 

for greater than 2.2 ms. The 
microprocessor is in a run state and 
commands can still be entered at the 
keyboard. 

NOTE 1: It is not possible to break on a 
HLT instruction or status. If you want to 
break on the HLT instruction it is necessary 
to set a breakpoint at an address one 
instruction before the HLT. 



B-2 



Appendix B: Error Messages 



NOTE 2: Normally when a HLT instruction 
is executed, the microprocessor waits for a 
reset or an interrupt to bring it out of that 
condition. When single stepping, the 
emulator uses an NMI to return to the 
internal world. Therefore when a HLT 
instruction is encountered it is executed and 
the processor goes on to the next instruction 
because the microprocessor was satisfied by 
the NMI that took it out of the HLT 
condition. 

PROCESSOR The microprocessor is waiting for a RDY 

WAITING (ready) to be returned. This message 

displays only if the microprocessor has been 
waiting for greater than 2.2 ms. When the 
condition has been corrected the message is 
removed. 

NOTE 1: It is necessary to use target RDY 
when overlaying dynamic RAM that uses 
the RDY line to halt microprocessor 
activity during refresh cycles. When a 
refresh cycle occurs on many systems the 
RDY line is held in the NOT RDY state 
until the refresh is complete. If an internal 
RDY is used, the microprocessor will not 
honor the REFRESH cycles and dynamic 
memory will be corrupted. The choice of 
internal or external RDY while using 
overlay memory is made by using the RDY 
switch (see page 5-20). 

NOTE 2: When overlaying nonexistent code 
space it is necessary to use the internal 
RDY. Users may want to overlay 
nonexistent code space (an area not decoded 
in their hardware) to patch in code. 
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NOTE 3: When selecting internal or 
external RDY for areas overlayed, that 
particular RDY is selected for all overlay. 
It is not possible therefore to overlay both 
dynamic RAM and nonexistent RAM at the 
same time. 

RESET ASSERTED This indicates that a reset from the target 

has been asserted for greater than 2.2 ms. 
When the reset is released then the message 
is removed. However, if the reset is less 
than 2.2 ms the message is not displayed. 
Using an oscilloscope, verify that the reset 
line is in fact being held reset. There are 
some operating systems that may normally 
hold the microprocessor reset until needed. 
If the reset line is not being held reset at the 
probe tip, unplug the emulator and verify 
the condition in the NULL TARGET 
mode. 



EMULATOR HARDWARE ERROR MESSAGES 



POD CPU NOT When a reset occurs, (power up, CTRL Z, 

INITIALIZED or RST) the controller and the emulator 

begin an initialization routine to establish 
communication. If this initialization 
routine fails to complete, this message is 
displayed. This is an internal pod, 
emulator, controller board problem. 
Correct the problem by reseating boards, 
cycling power, and verifying that the 
microprocessor is correctly installed in the 
pod, or replacing the microprocessor in the 
pod. 
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POD CPU NOT 
RESPONDING 



Whenever a STP command is executed, or a 
memory command is executed during 
emulation, the ES language software looks 
to see if any errors occurred during 
execution of the command. The emulator 
then checks if the command completed. If 
it did not complete the emulator checks to 
see if the microprocessor is still running or 
if there is an error condition. If an error 
condition exists then the appropriate 
message is displayed. However, if the 
microprocessor is still running and no error 
conditions exist then the message POD CPU 
NOT RESPONDING is displayed. Correct 
the problem by resetting the system and 
repeating the command. 



SYSTEM RESET 
ERROR 



When a reset (power up, CTRL Z, or RST) 
has been executed from the emulator 
controller and the emulator board does not 
acknowledge this, then a SYSTEM RESET 
ERROR message displays. This situation is 
an internal pod, emulator, or controller 
board problem. Try reseating boards, 
reseating pod cables, and cycling power. 



TARGET SOFTWARE ERROR MESSAGES 



MEMORY ACCESS 
VIOLATION 



The target program has attempted to access 
an area of target mapped as illegal (ILG). 
DM assists in determining which areas are 
mapped as illegal. DRT helps determine 
where the program was making the access. 



MEMORY WRITE 
VIOLATION 



If the target program attempts to write to 
the RAM overlay in an area that is mapped 
READ ONLY, this error occurs. Use the 
DM command and the raw trace (DRT) to 
look for write cycles. DM assists in 
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determining which areas are mapped as 
illegal. DRT helps determine where the 
program was making the access. 
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SERIAL DATA FORMATS 



In order to download a program into target memory, the ES 1800 needs 
some way to receive this data in an intelligible format. This Appendix 
describes the downloading formats which the ES 1800 understands. 
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MOS Technology Format 



Figure 8. Specifications for MOS Technology Data Files Copyright 1983, 
Data I/O Corporation; reprinted by permission. 



input 

DATA RECORD 



END-OF-FILE RECORD 



B 

C 



A 
A 
A 
A 



START CHARACTER 

BC = Byte Count. The hexadecimal number of data 
bytes in the record 



AAAA = Address of first data byte in record. AAAA 
in hexadecimal notation only 



HH = One data byte in hexadecimal notation 



B 

C 



C 

c 
c 

C 



START CHARACTER 

Byte Count. BC = 00 in End of File Record 
Record Count 

Checksum 



C 
C 
C 
C 



CCCC = Checksum. Two byte binary summation of 
preceding bytes in record (including address, and 
data bytes) in hexadecimal notation 

This space can be used for line feed, carriage return or 
comments. 

(Beginning of next record) 



LEGEND 

= Start Character 
BC = Byte Count (BO 00 in Record, BC = End of File Record) 
AAAA = Address Field 
CCCC = Checksum of Record 
RRRR - Record Count 
HH - Two Hexadecimal Digits (0:9, A:D) 



OUTPUT 



NOTES 



1) Number of bytes per record is variable. See Table 3.1 

2) Each line ends with nonprinting line feed, carriage return 
and nulls. 



2 Hex Characters = 1 byte 



Data Records 



BCAAMHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCC 
BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCC 
BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCC 
BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCC 
BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCC 
BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCC 
BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCC 
BCRRRRCCCC 
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Motorola Exorcisor Format 



Figure 9. Specifications for Motorola Exorciser / 16-BM Data Files/ 
Copyright J983, Data I/O Corporation; reprinted by permission. 



INPUT 

DATA RECORD 



SIGN ON RECORD OPTIONAL 



S 
1 

B 

C 

A 
A 
A 
A 

H 

H 
H 
H 



START CHARACTERS 



BC = Byte Count. The number of data bytes plus 3 (1 for 
checksum and 2 for address) in hexadecimal notation 



AAAA = Address of first date byte in record. AAAA in 
hexadecimal notation only 



HH = One data byte in hexadecimal notation 



SO Start characters of sign on record. Except 
for start characters SO record has same format as 
data record 



END OF FILE RECORD 



CC = Checksum. One's complement of binary summation 
, of preceding bytes in record (including byte count, 
address and data bytes] in hexadecimal notation 

, This space can be used for line feed, carriage return or 
comments 

(Beginning of next record) 



LEGEND 

50 = Optional Record Start Characters 

51 = Start Characters 
BC = Byte Count 

[(Date Butes/Record + 3] 
AAAA = Address of First Data Byte 
HH = Two Hexadecimal Digits (0-9, A-F) 

CC = Checksum of Record (one byte) 



B 

c 



A 
A 
A 
A 



START CHARACTERS 



Byte Count. BC = 03 in End of File Record 



Address 



Checksum 



OUTPUT 



NOTES 



1 ) Number of bytes per record is variable. See Table 3.1 . 

2) Each line ends with nonprinting line feed, carriage return 
and nulls 

3) Sign on record may precede data 



2 Hex characters 1 byte 



Data Records 



S1BCAW,HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC\ 
S1BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC I J 
S1 BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC > 
S1 BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC I 
S1 BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC ) 
S9BCAAAACC 



/ 
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Intel Intellec Format 



Figure 10. Specifications for Intel Intellec/8/MDS Data Files/ 
Copyright 1983, Data I/O Corporation; reprinted by permission. 



INPUT 

DATA RECORD 



B 

C 



A 
A 
A 
A 



C 
C 



LEGEND 

= Start Characters 
BC = Byte Count (Date Bytes/Record) 

AAAA - Address Field 
TT = Record Type 

H = One Hexadecimal Digit (0-9, a-fj 

CC = Checksum of Reccd 



END OF FILE RECORD 



START CHARACTER 

BC = Byte Count. The hexadecimal number of data bytes 
in the record 



AAAA = Address of first date byte in record. AAAA in 
hexadecimal notation only 



TT - Record Type (00) 

HH = One data byte in hexadecimal notation 



CC = Checksum. Negation (two's complement) of binary 
summation of preceding bytes in record (including byte 
count, address, and data bytes) in hexadecimal notation 

■ This space can be used for line feed, carriage return or 
comments 



A 
A 
A 
A 



START CHARACTER 

Byte Count BC = 00 in End of File Record 
Address 

TT Record Type (01) 



OUTPUT 



NOTES 



1 ) Number of bytes per record is variable. See Table 3.1 . 

2) Each line ends with nonprinting line feed, carriage return 
and nulls 



2 Hex characters i byte 



Data Records 



BCAAAATTHHHHHMHHHHHHHHHHHHHHHHHHHHHHHHHHCC | 
BCAAAATTHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC > 
BCAAAATTHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC J 
BCAAAATT 



7 
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Signetics/Absolute Object File Format 

Figure 11. Specifications for Signetics/Absolute Object Data Files 
Copyright 1983, Data I/O Corporation; reprinted by permission. 



INPUT 

DATA RECORD 



A 
A 
A 
A 

B 

C 

A 
C 

H 
H 



END OF RLE RECORD 



START CHARACTER 



AAAA = Address of first date byte in record. AAAA in 
hexadecimal notation only 



BC = Byte Count. The hexadecimal number of data bytes 
in the record 

AC = Address Check. Every byte is exclusive 0 Red with 
the previous byte, then rotated left one bit. 



HH = One data byte in hexadecimal notation 



A 
A 
A 
A 



B 
C 



START CHARACTER 



Address 



Byte Count. BC = 00 in End of File Record 



D DC = Data Check. Every byte is exclusive 0 Red with the 
C previous byte, then rotated left one bit. 

.This space can be used for line feed, carriage return or 
comments 

.(Beginning of next record) 



LEGEND 

= Start Characters 
AAAA = Address Field 
BC = Byte Count (Date Bytes/Record) 

AC = Address Check. Checksum of address and byte count 

HH = Two Hexadecimal Digits (0-9, A-F) 

DC = Data Check. Checksum of data in record 



OUTPUT 



NOTES 



1] Number of bytes per record is variable. See Table 3.1 . 
2) Each line ends with nonprinting line feed, carriage return 
and nulls 



2 HEX characters 1 byte 



7 



Data Records 



AAAABCACHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC 1 I 
AAMBCACHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC > 
AAAABCACHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCJ 
AAAABCAC 



7 
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Tektronix Hexadecimal Format 



Figure 12. Specifications for Tektronix Hexadecimal Data Files 
Copyright 1983, Data I/O Corporation; reprinted by permission. 



•MD| \T 

iNru i 

DATA RECORD 




/ » Start Character 



AAAA = Address of first date byte in record, 
(hexadecimal notation) 



BC = Byte Count. The hexadecimal number of data bytes 
in the record 

CC - Checksum. Eight bit sum of the four bit 
hexadecimal values of the six digits that make up the 
address and byte counts (hexadecimal notation) 



One data byte in hexadecimal notation 



CC = Checksum. Eight bit sum moduia »6 : of the iour 
bit hexadecimal values of the digits that make up the 
data bytes. 

Carriage Return 

(Beginning of next record) 



OUTPUT 

NOTES 

1 ) Number of bytes per record is variable. See Table 3 1 

2) Each line ends with nonprinting line feed, carriage return 
and nulls 



C 
C 



2 Hex characters 1 byte 



Data Records 



/AAAABCCCHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC I 
/AAAABCCCHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC > 
,'AAAABCCCHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC ) 
/AAAABCCC , ^ 

. End of File Record 
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ABORT RECORD 



// =Two Start Characters 



XX. X = Arbitrary string of ASCII characters 



Carriage Return 



END OF FILE RECORD 



C 
C 



START CHARACTER 



AAAA Transfer Address 



Byte Count BC = 00 in End of File Record 

CC = Checksum Eight bit sum of the four bit 
hexadecimal values of the six digits that make up 
the transfer address and the byte count 
(hexadecimal notation) 

Carriage return 



LEGEND 

- Start Characters 
AAAA = Address Field 
BC = Byte Count (Date Bytes/Record) 

CC = Checksum of Record 

HH = Two Hexadecimal Digits (0-9. A-F) 

X = Any ASCII Character 
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Extended Tekhex Format 

Copyright 1983, Tektronix; reprinted by permission 
Extended Tekhex uses three types of message blocks: 

1 . The data block contains the object code. 

2. The symbol block that contains information about a 
program section and the symbols associated with it. This 
information is only needed for symbolic debug. 

3. The termination block contains the transfer address and 
marks the end of the load module. 

NOTE 

Extended Tekhex has no specially defined abort block. 
To abort a formatted transfer, use a Standard Tekhex 
abort block. 

Each block begins with a six-character header field and ends with an end- 
of-line character sequence. A block can be up to 255 characters long, not 
counting the end-of-line character. The header field has the format 
shown in the following table. 
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ITEM 

% 


NUMBER 
OF ASCII 
CHARACTERS 
1 


DESCRIPTION 

A permit sign specified that the block is 
in Extended Tekhex format. 


Block 
Length 


2 


The number of characters in the block: a 
two-digit hex number. This count does not 
include the leading % or the end-of-line. 


Block 
Type 


1 


6 = data block 

3 = symbol block 

8 = termination block 


Checksum 


2 


A two-digit hex number representing the 
sum, mod 256, of the values of all the 
characters in the block, except the leading 
%, the checksum digits, and the end-of-line. 
The following table gives the values for 
all characters that may appear in Extended 
Tekhex message blocks. 



Character Values for Checksum Computation 



CHARACTERS 


VALUES (DECIMAL) 


0..9 


0..9 


A..Z 


10.. 35 


$ 


36 


% 


37 


. (period) 


38 


_ (underscore) 


39 


a. .z 


40-65 
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VARIABLE-LENGTH FIELDS 

In Extended Tekhex, certain fields may vary in length from 2 to 17 
characters. This practice enables you to compress your data by eliminating 
leading zeros from numbers and trailing spaces from symbols. The first 
character of a variable-length field is a hexadecimal digit that indicates the 
length of the rest of the field. The digit 0 indicates a length of 16 
characters. 

For example, the symbols START, LOOP, and KLUDGESTARTSHERE 
are represented as 5START, 4LOOP, and OKLUDGESTARTSHERE. The 
values 0, 100H, and FF0000H are represented as 10, 3100, and 6FF0000. 

DATA AND TERMINATION BLOCKS 

If you do not intend to transfer program symbols with your object code, 
you do not need symbol blocks. Your load module can consist of one or 
more data blocks followed by a termination block. The following table 
gives the format of a data block and a termination block. 



Extended Tekhex Data Block Format 



ITEM 
Header 



# OF ASCII 
CHARACTERS 
6 



DESCRIPTION 

Standard header field 

Block Type = 6 



Load Address 



2 to 17 



The address where the object code is to be 
loaded: a variable- length number. 



Object 



2n 



n bytes, each represented as two hex 
digits. 
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Extended Tekhex Termination Block 


Header 6 


Standard header field 




Block type = 8. 


Transfer Address 2 to 17 


The address where program execution is to 




begin: a variable- length number. 



SYMBOL BLOCKS 

A symbol used in symbolic debug has the following attributes: 

1. The symbol itself: 1 to 16 letters, digits, dollar signs, 
periods, a percent sign, or symbolize a section name. 
Lower case letters are converted to upper case when they 
are placed in the symbol table. 

2. A value: up to 64 bits (16 hexadecimal digits). 

3. A type: address or scalar. (A scalar is any number that is 
not an address.) An address may be further classified as a 
code address (the address of an instruction) or a data 
address (the address of a data item). As symbolic debug 
does not currently use the code/data distinction, the 
address/scalar distinction is sufficient for standard 
applications of Extended Tekhex. 

4. A global/local designation. This designation is of limited 
use in a load module, and is provided for future 
development. If the global/local distinction is not 
important for your purposes, simply call all your symbols 
global. 

5. Section membership. A section may be thought of as a 
named area of memory. Each address in your program 
belongs to exactly one section. A scalar belongs to no 
section. 

The symbols in your program are conveyed in symbol blocks. Each symbol 
block contains the name of a section and a list of the symbols that belong to 
that section. (You may include scalars with any section you like.) More 
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than one block may contain symbols for the same section. For each 
section, exactly one symbol block should contain a section definition field, 
which defines the starting address and length of the section. 

If you object code has been generated by an assembler or compiler that 
does not deal with sections, simply define one section called, for example, 
MEMORY, with a starting address of 0 and a length greater than the 
highest address used by your program; and put all your symbols in that 
section. 

The following table gives the format of a symbol block. Tables that follow 
give the formats for section definition fields and symbol definition fields, 
which are parts of a symbol block. 



Extended Tekhex Symbol Block Format 


ITEM 
Header 


NUMBER 
OF ASCII 
CHARACTERS 
6 


DESCRIPTION 

Standard header field 

Block Type = 3 


Section Name 


2 to 17 


The name of the section that contains the 
symbols defined in this block: a 
variable- length symbol. 


Section 
Definition 


5 to 35 


This field must be present in exactly one 
symbol block for each section. This field 
may be preceded or followed by any number 
of symbol definition fields. The table on 
the next page gives the format for this 
field. 


Symbol 


5 to 35 


Zero or more symbol definition fields as 
described in the next table. 
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Extended Tekhex Symbol Block: 


Section Definition Field 


ITEM 
0 


NUMBER 
OF ASCII 
CHARACTERS 
1 


DESCRIPTION 

A zero signals a section definition field. 


Base 


2 to 17 


The starting address of the Address 
section: a variable-length number. 


Length 


2 to 17 


The length of the section: a variable-length 
number, computed as 1 + (high address base 
address) . 



Extended Tekhex Symbol Block: 


Symbol Definition Field 




NUMBER 






OF ASCII 




ITEM 


CHARACTERS 


DESCRIPTION 


Type 


1 


A hex digit that indicates the global/local 






designation of the symbol, and the type of 






value the symbol represents: 






1 = global address 






2 = global scalar 






3 = global code address 






4 = global data address 






5 = local address 






6 = local scalar 






7 = local code address 






8 = local data address 


Symbol 


2 to 17 


A variable- length symbol. 


Value 


2 to 17 


The value associated with the symbol: a 






variable- length number. 



The following figures show how the preceding tables of information might 
be encoded in Extended Tekhex. The information for the Extended 
Tekhex Symbol Block illustration could be encoded in a single 96-character 
block. It is divided into two blocks for purposes of illustration. 
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Extended Tekhex Symbol Block: 


oyuiuui UcT im t ion rleLG 




NUMBER 






OF ASCII 




T t ru 

ITEM 


CHARACTERS 


UtbLKlr 1 ION 


Type 


1 


a nex digit that indicates the global/local 






designation of the symbol,- and the type of 






value the symbol represents: 






i - global address 






2 = global scalar 






3 = global code address 






4 = global data address 






5 = local address 






o - locai scalar 






7 = local code address 






8 = local data address 


Symbol 


2 to 17 


A variable- length symbol. 


Value 


2 to 17 


The value associated with the symbol: a 






variable- length number. 



The following figures show how the preceding tables of information might 
be encoded in Extended Tekhex. The information for the Extended 
Tekhex Symbol Block illustration could be encoded in a single 96- 
character block. It is divided into two blocks for purposes of illustration. 
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Figure 13. Extended Tekhex Data Block 



Block length: 15H = 21 

Checksum: 1CH = 28 = 1 +5+6+3+1 +0+0+0+2+0+2+. 
■ Object Code: 6 bytes 



I 



%1561C3100020202020202 



I 



Load address: 100H 
Block type: 6 
Header character 



Figure 14. Extended Tekhex Termination Block 



Block length: 8 

Checksum: 1AH = 26 = 0+8+8+2+8+0 



%0881A280 



t 



Transfer address: 80H 
Block type: 8 
Header character 
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Figure 15. Extended Tekhex Symbol Block 



Block length: 37H = 55 

Checksum: 60H = (3+7+3+8+28+31 +12+28+29+...)mod 256 



Section definition field: 
base address = 40H; length = C6H 



ri r 1 ! I 1 



c 

%373608SVCSTUFF02402C622CRlD14OPEN25014READ25815WRITE260 
STUFI 

IT 



%373C 88SVCSTUFF15 CLOSE26814EXIT27029BUFLENGTH28013BUF278 



Section name: 
Block type: 3 
Header character 
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Motorola S-Record Format 

S- RECORD CONTENT 

When viewed by the user, S-records are essentially character strings made 
of several fields which identify the record type, record length, memory 
address, code/data, and checksum. Each type of binary data is encoded as 
a 2-character hexadecimal number: the first character representing the 
high-order 4 bits, and the second the low-order 4 bits of the byte. 

The 5 fields which comprise an S-record are: type, length, address, 
code/data and checksum. 

The fields are composed as follows: 



FIELD 


PRINTABLE 
CHARACTERS 


CONTENTS 


type 


2 


s-record type -- SO, S1, etc. 


record length 


2 


The count of the character pairs in the 
record, excluding the type and record length. 


address 


4, 6, or 8 


The 2-, 3-, or 4-byte address at or which the 
data field is to be loaded into memory. 


code/data 


0-2n 


From 0 to n bytes of executable code, memory- 
loadable data, or descriptive information. 
For compatibility with teletypewriters, some 
programs may limit the number of bytes to as 
few as 28 (56 printable characters in S- 
record). 


checksum 


2 


The least significant byte of the one's 
complement of the sum of the values 
represented by the pairs of characters making 
up the record length, address, and the 
code/data fields. 



Each record may be terminated with a CR/LF/NULL. Additionally, an S- 
record may have an initial field to accommodate other data such as line 
numbers generated by some time-sharing systems. 
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Accuracy of transmission is ensured by the record length (byte count) and 
checksum fields. 

S-RECORD TYPES 

Eight types of S-records have been defined to accommodate the several 
needs of the encoding, transportation, and decoding functions. The 
various Motorola upload, download, and other file-creating or debugging 
programs, utilize only those S-records which serve the purpose of the 
program. For specific information on which S-records are supported by a 
particular program, the user's manual for that program must be consulted. 

An S-record format module may contain S-records of the following types: 

50 The header record for each block of S-records. The 
code/data field may contain any descriptive 
information identifying the following block of S0- 
records. Under VERSAdos, the resident linker's 
IDENT command can be used to designate module 
name, version number, revision number, and 
description information which will make up the header 
record. The address field is normally zeros. 

51 A record containing code/data and the 2-byte address 
at which the code/data is to reside. 

52 A record containing code/data and the 3 -byte address 
at which the code/data is to reside. 

53 A record containing code/data and the 4 -byte address 
at which the code/data is to reside. 

S5 A record containing the number of SI, S2, and S3 

records transmitted in a particular block. This count 
appears in the address field. There is no code/data 
field. 

S7 A termination record for a block of S3 records. The 

address field may optionally contain the 3-byte address 
of the instruction to which control is to be passed. 
There is no code/data field. 
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58 A termination record for a block of S2 records. The 
address field may optionally contain the 3 -byte address 
of the instruction to which control is to be passed. 
There is no code/data field. 

59 A termination record for a block of SI records. The 
address field may optionally contain the 2 -byte address 
of the instruction to which control is to be passed. 
Under VERSAdos, the resident linker's ENTRY 
command can be used to specify this address. If not 
specified, the first entry point specification 
encountered in the object module input will be used. 
There is no code/data field. 

Only one termination record is used for each block of S-records. S7 and S8 
records are usually used only when control is to be passed to a 3- or 4- byte 
address. Normally, only one header record is used, although it is possible 
for multiple header records to occur. 

CREATION OF S-RECORDS 

S-record-format programs may be produced by several dump utilities, 
debuggers, VERSAdos' resident linkage editor, or several cross assemblers 
or cross linkers. ON EXORmacs, the Build Load Module (MBLM) utility 
allows an executable load module to be built from S-records; and has a 
counterpart utility in BUILDS, which allows an S- record file to be created 
from a load module. 

Several programs are available for downloading a file in S- record format 
from a host system to an 8-bit microprocessor-based or 16-bit 
microprocessor-based system. Programs are also available for uploading 
an S-record file to or from an EXORmacs system. 

Example: Shown below is a typical S-record-format module, as printed or 
displayed: 
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S0060000484421B 

S1130000285F245F2212226A00042429000082337CA 
S1 13001 00002000080008262900185381 2341 001813 
S1 13002041 E9000084E42234300182342000824A952 
SI 07003000 144Ed492 
S9030000FC 



The module consist of one SO record, four SI records, and an S9 record. 
The SO record is comprised of the following character pairs: 



so 


S- record type SO, indicating that it is a header record. 


06 


Hexadecimal 06 (decimal 6), indicating that six character pairs (OR 
ASCII bytes) follow. 


00+ 
00 


Four-character 2-byte address field, zeros in this example. 


48 

44+ 

52 


ASCII H, D, and R • "HDR". 


1B 


The checksum. 


The first SI record is explained as follows: 


S1 


S- record type S1, indicating that it is a code/data record to be 
loaded/verif ied at a 2-byte address. 


13 


Hexadecimal 13 (decimal 19), indicating that 19 character pairs, 
representing 19 bytes of binary data, follow. 


00+ 


Four-character 2-byte address field; hexadecimal address 


00 


0000, where the data which follows is to be loaded. 



The next 16 character pairs of the first SI record are the ASCII bytes of the 
actual program code/data. In this assembly language example, the 
hexadecimal opcodes of the programs are written in sequence in the 
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code/data fields of the SI records: 



OPCODE 



INSTRUCTION 



285 F 
245 F 
2212 



226A0004 
24290008 
237C 



o 



2A 



MOVE.L (A7) +,A4 

MOVE.L (A7) +,A2 

MOVE.L (A2),D1 

MOVE.L 4(A2),A1 

MOVE.L FUNCTI0N(A1),D2 

MOVE.L #F0RCEFUNC,FUNCTI0N(A1) 

(The balance of this code is continued in the code/data 
fields of the remaining S1 records, and stored in memory 
location 0010, etc.) 
The checksum of the first S1 record. 



The second and third SI records each also contain $13(19) character pairs 
and are ended with checksums 13 and 52 respectively. The fourth SI 
record contains 07 character pairs and has a checksum of 92. 

The S9 record is explained as follows: 



S9 S- record type S9, indicating that it is a termination record. 

03 Hexadecimal 03, indicating that three character pairs (3 bytes) follow. 

00 The address field, zeros. 

FC The checksum of the S9 record. 



Each printable character in an S-record is encoded in hexadecimal (ASCII 
in this example) representation of the binary bits which are actually 
transmitted. 
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- A- 

Absolute address, 5-91 

Absolute value, 4-16 

Acknowledge char, 5-3 

Address 

Branch to, 7-25 
Comparators, 7-3 
Registers, 5-90 

Alpha/numeric value, 4-8 

AND, 4-15,7-8 

ASM, 6-30 

Assembler, 4-24, 6-30 
Directives, 6-32 
Prompt, 4-23 
Single step, 5-110 



- B - 

Backspace, 4-25 
Base 

Default, 5-86 

Override default, 4-12, 5-86 
Register, 4-11 
BAS, 5-80 

Baud rate, 3-10, 5-3, 5-29 
BKX, 5-13 
Block data 

Verify, 6-22 
Block move, 6-23 

Verify, 6-25 



BMO, 6-23 

BNC connector, 3-6, 7-23 

Break 

Emulation, 7-14 
On execution, 5-13 
On NMI, 7-6 
On odd address, 7-4 
On pre-fetch, 5-13 

Breakpoint, 6-2, 7-14 

Bus cycles, 5-94 

BUS, 6-76 

Byte mode, 4-24 



- C - 

Cables, 3-8, 3-14 
CCT,5-30, 5-33, 5-36 
CDH, 5-14 
CES,7-13 
Change SF0, 6-53 
Checksums, 5-39 
CK,5-15 
Clear 

Memory map, 5-60 

WHEN/THEN statements, 7-13 
CLK, 6-74 
CLM, 5-60 

Clock, 5-15, 6-74, B-2 
CMC, 5-106 
Code space, 5-61 
Colon operator, 5-111 
Commands 
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Abbreviations, 7-1 

Arguments-Reducing 
typing, 5-90 

Command line, 4-6 

Commonly used, 4-21 

Configure system, 5-1 

Delay execution, 6- 1 1 

Exceptions, 4-6 

Extend command line, 4-6 

Language overview, 1 -6 

Memory, 6-15 

Mnemonics, 4-8 

Port dependent, 5-30 

Repeating, 5-92, 5-107, 5-110 

Run mode, 6-2 

Save space/typing, 5-88 

Single character, 4-7 

Terminator sequence, 5-3 
Communication 

With host, 5-30 

With target programs, 5-48 
Comparator registers, 7-2 
Computer port control, 5-40 
COM, 5-48 
Configuration 

Menus, 5-1 

System, 1-4 
Control 

Boards, 3-3 

Characters, 4-25 
Copy system variables, 5-27 
Count bus cycles, 7-19 
Counter/timer use, 3-6, 7-23 
Counting events, 7-19 
Count limit comparator, 7-7 
CPY, 5-16 
CRC, 6-75 
CRE, 6-75 
CRO, 6-75 
CRT length, 5-3 
Ctrl Q, 4-25 
Ctrl R, 4-25 
Ctrl S, 4-25 
Ctrl X, 4-25 
Ctrl Z, 4-25 

Customer service, 2-6, 2-10 
Cyclic redundancy check, 6-73, 



- D - 

Data 

Buffering, 5-29 
Comparator registers, 7-4 
Data space, 5-61 
Downloading, 5-38 
Enable, 5-17 

General purpose registers, 5-88 

Requirements, 3-12 

Serial data formats, C- 1 

Upload, 5-44 
DB-25 connectors, 5-29 
DB,6-17 

Debugging code with no 

hardware, 5-15 
Default base, 5-86 

Register, 4-11 
Delete line/character, 4-25 
DEL, 5-120 
DES, 7-11 
DFB, 5-86 
Diagnostics 

CRC check of emulator 

firmware, 6-73 
Force null operations, 6-70 
Functions, 1-10, 6-50 
RAM test - looping - 

complete, 6-58 
RAM test - looping - 

simple, 6-56 
RAM test - single pass - 

complete, 6-55 
RAM test - single pass - 

simple, 6-53 
Read data over entire 

range, 6-72 
Read from address, 6-62 
Toggle data at address, 6-60 
Write alternate patterns, 6-65 
Write data then read, 6-69 
Write data to address, 6-63 
Write incrementing value, 6-71 
Write pattern then rotate, 6-67 
DIA, 5-52 
Disassemble, 6-36 
Single step, 5-107 
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Index 



Trace memory, 5-98 

Trace page, 5-101 
Display 

Base, 5-86 

Bus status, 6-76 

Character string, 5-52 

Event specifications, 7- 1 1 

Improve readability, 5-124 

Memory block, 6-17 

Raw trace bus cycles, 5-94 

Revision dates, 5-123 

Symbols, 5-116 
DIS, 6-36 
DMA halt, 5-14 
DME, 5-17 
DM, 5-55 
DNL, 5-31,5-38 

Don't care values, 4-11, 5-64, 5-88, 

7-4, 7-6 
Download 

Corruption, 5-43 

Errors, 5-41 

From computer port, 5-31 

From terminal port, 5-31 

Hex format files, 3-10 

Port control differences, 5-40 

Procedures, 5-38 

Record format, 5-7 

Symbols, 5-40 
DR, 5-74 
DRT, 5-94 
DTB, 5-101 
DTF, 5-101 
DT, 5-98 

Dynamic memory, 5-17 



- E - 

EEPROM 
Groups, 5-2 
Initialize, 5-26 

Save configuration, 5-1,5-10, 
5-25 

EMS control statements, 7-8 
Emulation, 6-2 

Breaking, 7-14 

Halting, 6-3 

Resetting, 6-4 



Run mode, 6-2 

Starting, 6-2 
Emulator 

Chassis rear panel, 3-6 

Control boards, 3-3 

Hardware error messages, B-4 

Setup, 2-1 
Enable data, 5-17 
END, 6-30 

Error messages, 4-26, B-l 

Emulator hardware, B-4 

ES language, 4-27 

Target hardware, B-l 

Target software, B-5 
Escape sequence, 5-3 
Esc esc, 4-25 
ES language, 1-6,4-1 

Illegal statement, 4-1 

Mnemonics, A-l 

Syntax, 4-2 
Event, 7-8 

Event Monitor System, 4-14, 7-1 

Address comparators, 7-3 

Clear WHEN/THEN, 7-13 

Comparator registers, 7-2 

Count events, 7-19 

Data and LSA comparators, 7-4 

Define action list, 7-9 

Define event, 7-8 

Event group changes, 7-27 

Groups, 7-1, 7-8, 7-27 

Help menu, 4-22 

Interrupts, 7-25 

Registers, 5-73 

Status comparators, 7-4 

Status mnemonics, 7-5 

Trace events, 7-16 

Trigger signal, 7-23 
Event specs - display, 7-11 
Expression, 4-8 

- F - 

Fan filter, cleaning, 3-15 
Files 

Closing, 5-45, 5-47 
Opening, 5-46 
Viewing, 5-45 
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Fill operator, 6-21 
FIL, 6-21 

Find memory pattern, 6-19 

FIN, 6-19 

FLX register, 5-75 

Forced special interrupt, 5-18 

Force null operations, 6-70 

FSX, 5-18 

Fuse, 3-7 



-G- 

GD, 5-88 

General purpose address 

registers, 5-90 
Ground system, 3-1 
Groups, 4-14, 7-8, 7-27 
GR, 5-90 



- H - 

Hard copy, 5-1 1, 5-16 
Help, 4-20 

Communications set-up, 4-20 

Software switches, 4-20 

Special diagnostic 
functions, 4-20 
Host computer, 5-29 

Communication with, 5-30 



- I - 

IDX, 5-107 
ILG, 5-57 

Indirection operator, 4-9, 4-13 
Interrupts 

Force special interrupt, 7-25 

Spcl interrupt register, 7-25 

Switch setting, 5-22 
I/O address space 

Modifying, 6-38 

Viewing, 6-38 
I/O mode, 4-24, 6-38 

Entering, 6-43 

Exiting, 6-45 

Pointer, 5-85, 6-47 
IOP, 5-85, 6-47 



- L - 

LD, 5-27 
LDV, 6-9 
LIM, 5-107 

Line assembler, 4-24, 6-30 

Prompt, 4-23 
Load 

Overlay memory, 5-62, 6-27 

Reset vectors, 6-9 

Variables from EEPROM, 5-27 
Loading registers, 5-79 
Logic State Analyzer (LSA), 1-10, 

3-6,3-9 
LOV, 5-62, 6-27 
LST, 6-46 



- M - 

MAC, 5-103 
Macros, 5-102 

Clearing, 5-106 

Define/execute, 5-104 

Displaying, 5-103 

Saving, 5-102 

Using registers, 5-88, 5-90 
Maintenance, 3-14 
MAP, 5-56 
Memory 

Alternate overlay/target, 5-11 

Assembler, 6-30 

Block display, 6-17 

Clear overlay map, 5-60 

Commands, 6-15 

Disassembler, 4-24, 6-36 

Display overlay map, 5-55 

Download to overlay, 5-38 

Enable overlay, 5-61 

Fill with data, 6-21 

Find data pattern, 6-19 

Illegal, B-5 

Load overlay, 6-27 

Load target to overlay, 5-62 

Map overlay, 5-56 

Mode, 6-38 

Modify, 6-38 

Overlay, 5-54 
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Index 



Overview, 1-7 

Read only, B-5 

Scrolling, 6-17 

Scroll through, 6-38 

Trace (see also Trace), 5-93 

Verify overlay, 5-63, 6-28 

Viewing, 6-38 
Memory mode, 4-24 

Entering, 6-40 

Exiting, 6-45 

Modifying data, 6-41 

Pointer, 5-83, 6-48 

Prompt, 4-23 

Scrolling, 6-46 

Status register, 5-82 
Microprocessor registers, 5-70, 

5- 74 
MIO, 6-43 
MMP, 5-83, 6-48 
MMS, 5-82 
Modes 

I/O (see also I/O mode), 4-24, 

6- 38 
Memory, 6-38 
Pause, 7-14 
Run, 6-1 
Special, 4-24 
Transparent, 5-33 

M, 6-40 



- N- 

NOT, 4-15,7-8 
Null modem cable, 2-3 
Null target, 1-7 
Numbers, 4-11 
Signed, 4-16 
NXT, 6-46 



- O - 

Odd addresses, 7-4 
OFF, 5-9 

ON/OFF menu, 5-1, 5-9 

ON, 5-9 

Operators 

Dyadic operator 



combinations, 4-19 
Indirection, 4-9, 4-13 
Precedence, 4-17 
Repeat, 5-107 
Single argument, 4- 1 8 
Unary, 4-16 
OR, 4-15, 7-8 

Oscilloscope use, 1-10, 6-50, 7-23, 
B-4 

Overlay map, 5-57 
Overlay memory (see also 

Memory), 1-8 
OVE, 5-61 



- P - 

Parentheses, 4-8,7-8 

Indirection, 4-13 

WHEN/THEN, 4-15 
Parity, 5-3 
Parts, 3-18 
Patch code, 7-25 
Pause mode, 1-6, 7-14 
PCB registers, 5-71 

iRMX mode, 5-72 

Non-iRMX mode, 5-73 
Peeks, 6-62 

Peripheral equipment, 3-6 
Pin configurations, 3-10 
Pod assembly, 3-8 
Pokes, 6-63 
Ports, 3-6 

Baud rate, 3-10 

Commands, 5-30 

Computer control, 5-36 

Configuration, 5-3, 5-29 

Control, 5-30 

Controlling port, 5-36 

Data to, 5-16 

Download data, 5-38 

Port control, 3-10, 5-33, 5-35, 
5-36 

Terminal control, 5-35 
Upload/download, 3-10 

Power specs, 3-20 

Power supply, 3-1 

Power-up sequence, 2-5 

Prefetch, 5-13, 5-18 
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Print session, 5-11,5-16 
Probe tip assembly, 3-14 
Prompts, 4-23 
PUR, 5-121 



- R - 

RAM 

Testing (see also 
Diagnostics), 6-50 
Range, 4-1 i 
RBK, 6-5 
RBV, 6-5 
RCS, 5-19 
RDY, 5-20 
Readability, 5-124 
Read chip select, 5-19 
Ready signal, 5-20 
Real time, 1-7 
Registers, 5-64 

Address, 7-3 

Clear microprocessor, 5-74 
Comparator, 7-2-7-5 
Count, 7-19 
Count limit, 7-7 
Data, 5-82, 7-4 
Display, 5-74 
Display base, 5-64, 5-80 
Event Monitor System, 5-73 
General Emulator, 5-70 
General purpose, 5-102 
General purpose address, 5-90 
General purpose data, 5-88 
Listing, 5-70, 5-71, 5-72, 5-73 
Load, 5-74, 5-79 
Logic state probe, 7-4 
Memory mode pointer 

MMP, 6-38 
Microprocessor, 5-70 
Overlay memory, 5-54 
PCB, 5-72, 5-73 
Reset status, 6-13 
Saving, 5-64 
Set/display base, 5-80 
Status, 7-4 

Target peripheral control 

block, 5-71 
Types, 4-12 



Using in run mode, 6-4 
Repeat command line, 4-6, 5-107, 
5-110 

Reset 

Character, 5-3 

Pod microprocessor, 6-13 
RET, 5-124 
Revision dates, 5-123 
REV, 5-123 
RNV, 6-5 
*, 5-107 
/, 5-110 
RO, 5-57 
RST,6-13 
Run 

Commands, 6-2 

Mode, 6-1, 6-2 

Mode prompt, 4-23 

Target program, 6-5 
Run mode, 7-1 
RUN, 6-5 
RW, 5-56 



- S- 

Saved 

ON/OFF menu, 5-1 

Parameters, 5-8 

Registers, 5-64 

SET menu, 5-1 

Switches, 5-10 

System variables, 5-25 
SAV, 5-25 
Scope loops, 6-50 

Scroll through memory, 6-17, 6-46 
SEC, 5-117 
Sections, 5-111 

Deleting, 5-120, 5-121 

Display, 5-117 
Serial 

Communications, 5-29 
Ports (see also Ports), 3-6 

Serial data formats, C- 1 

Service, 0-4, 2-6,2-10 

SET, 5-3 

SET menu, 5-1, 5-3 
Setup 

Emulator, 2-1 
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System, 1-4 

Target system, 2-4 
SF 10, 6-70 
SF 11, 6-71 
SF 12, 6-72 
SF 13, 6-73 
SF 1,6-55 
SF 24, 6-60 
SF 25, 6-62 
SF 26, 6-63 
SF 27,6-65 
SF 28, 6-67 
SF 29, 6-69 
SF 30, 6-70 
SF 31, 6-71 
SF 32, 6-72 
SF3,6-58 
SF 4, 6-60 
SF 5, 6-62 
SF6,6-63 
SF7,6-65 
SF8,6-67 
SF9,6-69 
SF 

0-32 (See also Diagnostics), 6-53 
Special characters, 4-25 
Special functions 

(See also Diagnostics), 6-52 
Special interrupts, 7-25 
Special modes, 4-24 
Specifications 

ES 1800 Emulator, 3-20 
S-records 

creation, C-17 

types, C-16 
Status comparators, 7-4 
STI, 5-22 

Stop and step target system, 6-7 
Stop bits, 5-3 
Switches, 5-9 

Break on instruction 

execution, 5-13 
Copy data to both ports, 5-16 
FSI on instruction 
execution, 5-18 
Internal/external clock, 5-15 
Internal/external ready 
signal, 5-20 



Step through interrupts, 5-22 
Symbols, 4-10, 5-111 

Define, 5-118 

Deleting, 5-120, 5-121 

Display, 5-116 

Downloading, 5-40 

Symbolic debugger, 1-9 

Tables, 5-1 11 

Uploading, 5-46 
SYM, 5-116 
System 

Configuration, 1-4 

Operation, 1-6 

Setup, 1-4 

Variables, 5-25 
System setup, 5-1 



- T - 

Target, 6-1 

Commands, 6-1 
Communication with, 5-48 
Cyclic redundancy check, 6-75 
Definition, 6-1 
Display characters from 

memory, 5-52 
Download to, 5-38 
Hardware errors, B-l 
Load into Emulator, 6-27 
Null, 1-7 

Peripheral control block 
registers, 5-71 

Read clock, 6-74 

Run program, 6-5 

Software error messages, B-5 

Stop and step system, 6-7 

System peeks, 6-62 

System pokes, 6-63 

System setup, 2-4 
TCT, 5-30, 5-33, 5-35 
Temperature, 3-20 
Terminal port control, 5-39 
Test run of system, 2-6 
TGT, 5-57 

Thumbwheel switch, 2-2, 3-3, 3-4 
Timers, 5-23 

Toggle data at address, 6-60 
Trace 
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A subroutine, 7-27 

Bus cycles, 7-16 

Disassemble memory, 5-98 

Disassemble page, 5-101 

Display bus cycles, 5-94 

Events, 7-16 

Memory, 1-7, 5-93 
Transparent mode, 4-24, 5-29, 
5-33 

Entering, 5-30 

Exiting, 5-30 
TRA, 5-33 
Trigger signal, 7-23 
Troubleshooting, 3-19 
TST, 5-92 



- W - 

WAI, 6-11 
Warranty, 0-5 

WHEN/THEN, 1-8, 7-1, 7-13 
Word mode, 4-24 



- X - 

XON/XOFF, 3-12, 5-3, 5-29, 

5-45,6-18 
X,6-30, 6-45 



- U - 

Unary operator, 4-16 
Upload 

Data, 5-44 

Hex format files, 3-10 
Record format, 5-7 
Record length, 5-7 
Symbols, 5-46 

UPL, 5-44 

UPS, 5-46 

Users 

Specify 0 or 1, 5-4 



- V - 

VBL, 6-22 
VBM, 6-25 
Vectors 

Load reset, 6-9 
Verify 

Block data, 6-22 

Block move, 6-25 

Overlay memory, 5-63, 6-28 

Serial data, 5-43 
VFO, 5-63, 6-28 
VFY, 5-43 
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P.O. Box 97002 
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(206) 882-2000 
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to quality service and support. For the address and phone number 
of the Applied Microsystems Corporation Sales Office nearest you, 
call 1-800-426-3925 (in WA, call 206-882-2000). 

Applied Microsystems' products are available throughout Europe. For the 
address and phone number of your nearest distributor, contact: Applied 
Microsystems Corporation, Ltd. Chiltern Court, High Street, Wendover, 
Aylesbury, Bucks, HP22 6EP, England. Tel 44(0) 296-625462 



